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FEDERAL BUREAU OF INVESTIGATION 



Details: On 11/18/2011, retired California Depar tment of Justice 

Special Agent Supervisor I I advised that he 

received text messages from his own Google telephone niamber 
indicating that he had been "owned" . 

On 11/18/2011, a YouTube video was posted with the 
title "#AntiSec Fuck FBI Friday V - Cybercrime Investigator 
ComTumn i rahi nn.q " from the YouTube user account 

I - The video was 6:03 long and stated the 

following information, which was also posted as text below the 
video : 


"Greetings Pirates, and welcome to another exciting #FuckFBIFriday release. 

As part of our ongoing effort to expose and h umiliate our white hat enemies, we targeted a Special Agent Supervisor 
of the CA Department of Justice in charge ofl I We are leaking over 38,000 private 

emails which contain detailed computer forensics techniques, investigation protocols as well as highly embarrassing 
personal information. We are confident these gifts will bring smiles to the faces of our black hat brothers and sisters 
(especially those who have been targeted by these scurvy dogs) while also making a mockery of "security 
professionals" who whore their "skills" to law enforcement to protect tyrannical corporativism and the status quo we 
aim to destroy. 







UNCLASSIFIED 



To: San Diego From: San Diego 

Re: 288A-SD-NEW, 12/01/2011 


We hijacked two gmail accounts belonging to I I who has been a cop for i ly ears, dumping hi s private 

email correspondence as well as se veral dozen voice mails and SMS text message logs. While just yesterday f | 
was having a private BBQ with his i ~l iigh computer crime task force friends, we were reviewing their 

detailed internal operation plans and proc edure d ocuments. We also couldn' t overlook the boatloads of embarrassing 
personal information about our cop friend! I We lulzed as we listened toL_ I 


Iwe turned on his google web history and watched him[ 


We also abused his google voice account, making sur4 Ifriends 


and family knew how hard he was owned- Possibly the most interesting content in his emails are th( 


] 


i I Xhe information in these emails will prove essential to 

those who want to protect themselves from the techniques and procedures cyber crime investigators use to build 
cases. If you have ever been bust ed for computer crimes, you should check to see if your case is being discussed 
here. There are discussions about! I 


These cybercrime investigators are supposed to be the cream of the crop, but we reveal the totality of their ignorance 
of all matters related to computer security. For months, we have owned several dozen white hat and law enforcement 
targets- getting in and out of whichever high profile government and corporate system we please and despite all the 
active FBI investigations and several billion dollars of funding, they have not been able to stop us or get anywhere 
near us. Even worse, they bust a few dozen people who jaie^alkaedlv part of an "anonymous computer hacking 
conspiracy" but who have only used kindergarten-level - this isn’t even hacking, but a form of electronic 

civil disobedience. 

We often hear these "professionals" preach about "full-disclosure," but we are sure these people are angrily sending 
out DMCA takedown notices and serving subpoenas as we speak. They call us criminals, script kiddies, and 
terrorists, but their entire livelihood depends on us, trying desperately to study our techniques and failing miserably 
at preventing future attacks. See we're cut from an entirely different kind of cloth. Corporate security professionals 
like Thomas Ryan and Aaron Barr think they're doing something noble by "leaking" the public email discussion lists 
of Occupy Wall Street and profiling the "leaders" of Anonymous. Wannabe player haters drop shitty dox and leak 
partial chat logs about other hackers, doing free work for law enforcement. Then you got people like Peiter "Mudge" 
Zatko who back in the day used to be old school lOpht/cDc only now to sell out to DARPA going around to hacker 
conventions encouraging others to work for the feds. Let this be a warning to aspiring white hat "hacker" sellouts and 
police collaborators: stay out the game or get owned and exposed. You want to keep mass arresting and brutalizing 
the 99%? We'll have to keep owning your boxes and torrenting your mail spools, plastering your personal 
information all over teh internets. 

Hackers, join us and rise up against our common oppressors - the white hats, the 1%’s 'private' police, the corrupt 
banks and corporations and make 2011 the year of leaks and revolutions! 

We are Anti-Security, 

We are the 99% 

We do not forgive. 

We do not forget. 

Expect Us!" 
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To: San Diego From: San Diego 

Re: 288A-SD-NEW, 12/01/2011 


A link was also prov ided on the Y ouTube page to the 


documents that were taken from 

i nfnT-m;^hi nn wag 1nr;qhpd at- 


Bccount . 


The 


Additionally, some of the information contained withi n 
account was posted at 


On 11/30/2011, California Department of Justice 
pr mT-i ded the Fp T with a CD-ROM disc containing the files located 
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at 


r 


These files are contained in a 1-A envelope to 


Mri g -Ft 1 anH are password protected with the following password: 


♦♦ 
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Precedence : ROUTINE 

To: San Diego 

From: San Diego 

CYl 

Contact : SA 


Date: 12/05/2011 


Approved By: 
Drafted By: 
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Case ID #: 288A-SD-73148 (Pending) 


Title: UNSUB ( S); 

^#ANTISEC; 


/ 



VICTIM; 


COMPUTER INTRUSION 


Gmail files from 


Synopsis: Document collection of 

I I 

Details: On 12/01/2011, following a determination that the CD- 

ROM disc obtained fr om the California Department of Justice had 


t 


become corrupted, SA 


visited the website 
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and downloaded the torrent 
containing the contents of the Gmail files exfiltrated from 
I accounts . The contents included one zipped file 


The zipped file was placed on a CD-ROM disc and placed 
in the 1-A file. 


♦♦ 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 12 707 72011 


security account nunnberL 


1 d ate of birth [ 

I was interviewed at the San 


I social 


Also 


Diego Division of the Federal Bure au of Inves tigation. 

attending the interview were ITCFE T I and lA 

After being advised of the i dentity of the interviewing Agent and 
the nature of the interview, | 
information: 


] volunteered the following 


referred to the written statement he had 


previously submitted and advised that the information provided 
within was accurate. A copy of the written statement is contained 
in a 1-A envelope in the file. 


On 11/18/2011, at approximately 7:00 am PST, 
began receiving text messages on his cellular telephone from the 


] 


telephone number associated with his Google Voice account, 

I I The text messages were statements similar to "We nave 

you" and |"Wp nium -sfpu" . Additional text messages were received that 


bo enter an IRC chat -ronm i-n H-i am 


directed 

wi th thp individuals that had taken over 


accounts . 

advised that he did not reply to these messages and does 


iss the matter 


not recall the exact context of the message s or the n ame of the IRC 
chat room that they were directing him to. I I stated that he 
has deleted the text messages and has no record of them. 

Shortly after receiving the text messages fro m the 
individuals claiming they had compromised his accounts. 


began receiving telephone calls from friends and family members who 
advised him that they were receiving suspicious messages f rom him 
on Faceb ook. The individuals also advised that there wereQ 


and other out of character posts on his Facebook feed. 


had recovered and locked down all of his 


By noon| 

accounts. Text messages continued arriving on his cellular 
telephone that appeared to be from his Google Voice telephone 
nmn'hpr. Fearing that his Google account was still compromised, 
deleted the Google account. ■ 
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received 


Following the recovery of his accounts, 
a text message that stated that it wasn't over and a text message 
that made a reference to the tough economic times and financial 


Investigation on 

File# 288A-SD-73148 

by 


12/06/2011 at San Diego, CA 


SA 



A 


Date dictated 
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This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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288A-SD-73148 


Continuation of FD-302 of 


, On 12 / 061 2 011 , Page 


issues. I [checked his credit c ards and d iscovered that a 

fraudulent charge had been made on hi s i \ card from Ritz 

camera. The item was set tcp_sh±Q_to his old address. The 
card that was used ended in 


believed that the compromise could be related to 
his Android cellular telephone, which he had "rooted" . One of the 
consequences of rooting the telephone was that other programs that 
normally would not have access to the files "Shared Preferences"^ 
and "Accounts . db" c ould now access those files. The fil es contain 
information such as I I from the 

telephone. A few days prior to the in dividuals advising [ 


that he had been compromised^ 


Jhad downloaded and installed 

a program called "atorrent" from the Android store. This program 
allowed a n g<a-r ho rir)T« 7nl nad torrent files onto your cellular 
telephone. | stated that he used the program several times 

to test it, downloading music and a movie. 


] also stated that his laptop could have been a 


potential source of the compromise, but did not believe that it 
could have been his desktop computer. 

The password used for his Gmail account. 

The only other system that 
\ All other 

~l 


passwords were [ 
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accounts, 


A1 though # AntiSec claimed to compromise two Gmail 

b elieved t hat the second account compromised may 
have been his Yahoo! account,! I since he had to 

I I stated that he was 

unsure how they would have determined that he was the owner of the 
Yahoo ! account 


i 


] 


b6 

b7C 


he had created 
Additionally, 




was unaware if the Gmail account 
had been compromised. 


account or the password for it. 


] did not remember the exact name of that 


I advised that he has wiped the hard drives of 
both his laptop and desktop computers . He also stated that he has 
deleted his Google account that was compromised and reset his 





, . V 
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288A-SD-73148 


Continuation of FD-302 of 


, On 12/ 06/2011 , Page 


Android cellular telephone | 

all of the text messages he had received. 


which removed 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 01 / 05/2012 

On 12/31/2011, an individual posted information regarding' 
the compromise of the California State Law Enforcement Association 
(www.cslea.com) on www.pastebin.com. The information provided an 
explanation for the attack, e-mail communications from CSLEA 
personnel discussing the security of their website, as well as 
name, address, password, and credit card information for 
individuals related to CSLEA. Additionally, the me ssage stated 
that the compromise o f CSLEA was " how Special Agent I 1 

at the California DOJ 


Unit got humiliated last month" . 
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The referenced information has been printed out and 
attached to this document. 


01/05/2012 at San Diego, CA 


Investigation on 

File# 288A-SD-73148 ' ^ 
by SA ( 


Date dictated 
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This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 




loaned to y o 



1/5/12 


Hello comrades and thank^r joining us for the final phase of our cross count - Pastebin.com 

# w 

p A s T e: B I N 1-^1 i ' l oot siHcr- 2 oa; create new paste 


P A S T E B I ^3 Follow ©paslebin 


Cfif.AI i: PAS’t't (Kt NUiNO PASI ith 


TOOLS API ARChlVF 


search... 


SIGN UP '.OOIN MY SETT 


Untitled 

BY: AGUEST | DEC 31ST, 2011 I SYNTAX: NONE | SIZE: 71,51 KB | HITS: 2,862 1 EXPIRES: NEVER 
COPY TO CLIPBOARD ( DOWNLOAD | RAW | EMBED | REPORT ABUSE 


And rechamli^^ 



1. 

2 . 

3. 

4. 

5. 

6 . 

7. 

8 . 

9. 

10 . 

11 . 

12 . 

13. 

14. 

15. 

16. 

17. 

18. 

19. 

20 . 
21 . 
22 . 

23. 

24. 

25. 

26. 

27. 

28. 

29. 

30. 

31. 

32. 

33. 

34. 

35. 

36. 

37. 

38. 

39. 

40. 

41. 

42. 

43. 

44. 


Hello comrades and thanks for joining us for the final phase of our cross 
country hacker crime spree, our contribution to pr0j3kt m4yh3m. We're still 
preparing the torrents, mail spools, as well as our final txt zine release which 
will surely bring humiliation and embarrassment to many white hats and 
sysadmins. But this New Years Eve, we bringing yall some party favors to keep 
you raging all night. Did you remember a month ago when the mayors and piggies 
across the US conspired to attack protesters in public parks? We sure do, so we 
have been planning a retaliatory raid of our own. Bring it, NDAA. Bring it, 

SOPA. We are snipers with one hell of a scope! Takin out a cop or two, they 
can't cope with us! 


west coast - east coast 

/**:***it***ic^eik:^*******^*ilt****ieilriir****it*^^itirii*ilri>r****'^‘kik*'ikT/ri^'*iiriieirT^f****i(ie*'kitile**iir*ir**Tk* 

CALIFORNIA LAW ENFORCEMENT ASSOCIATION - DEFACED AND DESTROYED BY ANTI SEC 

*********ir****irii(*******ir*ilr****ir*if************-*****ilf******ic****it;*iie***ie****ir****ie/ 

Soundtrack to the Rev Track: The Coup - Five Million Ways to Kill a CEO 

http : //wvw. youtube . com/watch?v=lJotps9V4as 

I'm from the land where the Panthers grew 
You know the city and the avenue 
If you the boss we be smabbin through 
And we'll be grabbin* you 
To say "What's up with the revenue?" 

Most everybody already knov;s that we don't like police very much. Shit, just 
about everybody hates them, everybody except for the rich and powerful who 
depend on their protection. But which state got the most blood on their hands? 
Well we already owned pigs in Texas and Arizona, and many many others; guess its 
time to ride on the California police. 

From the murder of Oscar Grant, the repression of the occupation movement, the 
assassination of George Jackson in San Quinten prison, the prosecution of our 
anonymous comrades in San Jose, and the dehumanizing conditions in California 
jails and prisons today, California police have a notorious history of brutality 
and therefore have been on our hit list for a good minute now. 

So we went ahead and owned the California State Law Enforcement Association 
(CSLEA.COM), defacing their website and giving out live backdoors. We dumped a 
few of their mail spools and forum databases, and we did get a few laughs out of 
reading ye ars of their private email correspondence (such as CSLEA's Legisl ative 
and Police | 

. But what we were really after was their membership rosters, V7hich 
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45. 

46. 

47. 

48. 

49. 

50. 

51. 

52. 

53. 

54. 

55. 


Hello comrades and thanks for joining us for the final phase of our cross count - Pastebin.com 


included the cleartext passworo^l^ 2500 of their members, guaranteeing the 
ownage of many more California pigs to come. 


"But wait! Cops are people tool Part of the 99%!" orly? When these soulless 
traitors voluntarily chose to cross the picket line and side with the bosses and 
bureaucrats, they burned all bridges with working class. As the bootboys for 
capitalism they do not protect us, instead choosing to serve the interests and 
assets of the rich ruling class, the 1%. Many Occupiers are learning what many 
of us already know about the role of police in society when they violently 
attacked protesters occupying public parks. Now it*s time to turn the table and 
start firing shots off in the right direction. Problem, officer? 


56. 


57 . Interestingly, CSLEA members have discussed some of our previous hacks against 

58. police targets, raising concern for the security of their own systems. However 
deliberately made some rather amusing lies as to their security. He 

60. repeatedly denied having been hacked up until web hosts at | | showed him 

61. some of the backdoors and other evidence of having dumped their databases. We 

62. were reading their entire email exchange including when they realized that 

63. credit card and password information was stored in cleartext. This is about the 

64. time l ^ changed his email password, but not before receiving a copy of the 


66 . 


65. 'shopper' table which contained all the CCs. Too late 



67, In all fairness, they did make an effort to secure their systems after discovery 
68 

69 

70 

71 

72 

73 

74 

75 

76 

77 
78, 

79 
80. 

81 
82, 

83, 


of the breach 



But we still had 


and were stealthily checking out the 


many other websites on the server, while also helping ourselves to thousands of 
police usernames and passwords (it's how Special Agent^ 

California DOj| 


~| at the 

]onit got humiliated last month) . For two months, we 


passed around their private password list amongst our black hat comrades like it 
was a fat blunt of the dank shit, and now it's time to dump that shit for the 
world to use and abuse. Did you see that there were hundreds of 0doj.ca.gov 
passwords? Happy new years!! 


84 . /********************************************★********************************** 

85. LIST OF SITES HOSTED BY CSLEA, NOW WIPED OFF THE NET !!! 

86 . *******************************************************************************/ 

87. 


88. Association of Conservation Employees (ACE) 

89. Association of Criminalists-DOJ (AC-DOJ) 

90. Association of Deputy Commissioners (ADC) 

91. Association of Motor Carrier Operations Specialists (AMCOS) 

92. Association of Motor Vehicle Investigators of California (AMVIC) 

93. Association of Special Agent s-DOJ (ASA-DOJ) 

94. California Association of Criminal Investigators (CACI) 

95. California Association of Food and Drug Investigators (CAFDI) 

96. California Association of Fraud Investigators (CAFI) 

97. California Association of Regulatory Investigators and Inspectors (CARII) 

98. California Association of State Investigators (CASI) 

99. California Organization of Licensing Registration Examiners (COLRE) 

100. California Association of Law Enforcement Employees (CALEB) 

101. California Highway Patrol Public Safety Dispatchers Association (CHP-PSDA) 

102. Fire Marshal and Emergency Services Association (FMESA) 

103. Hospital Police Association of California (HPAC) 


4.8k 
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.244. 

.245. 

.246. 

.247. 

.248. 

.249, 

.250. 

.251. 

.252. 

.253. 

.254. 

.255. 

.256. 

.257. 


/ici(*icic'kic'kitic**it’kicie'kitieie-kici(i(it'kic*iciticic'k'kitie*-k**i:ic*'k**ic-kicici(i('kic-k'k-kic'k'k'k'kit*icicic'k'kie’kiti(ifkickiti( 


| yo 


LOLOLOL so MUCH FOR ’’ENCRYPTED MEMBER DATA". DAMN| |yOU DID HALF THE WORK 
FOR US. AND DESPITE BEING AWARE OF THE BREACH, YOU STILL COULD NOT KEEP US OUT. 

ON TO THE NEXT TARGET NEW YORK POLICE CHIEFS, OWNED AND EXPOSED 111 

*******************************************************************************/ 


Soundtrack to the Rev #3; Cop Killer by Ice-T 

http: / /wvTW. youtube, com/watch ?v=p5gRIud5 7 jQ 

I got my black shirt on. 

I got my black gloves on. 

I got my ski mask on. 

This shit's been too long. 


.258. I got my twelve gauge sawed off. 

.259. I got my headlights turned off. 

.260. I'm 'bout to bust some shots off. 

.261. I'm 'bout to dust some cops off. 

,262. 

.263. I'm a cop killer, better you than me. 

.264. Cop killer, fuck police brutality 1 

.265. Cop killer, I know your family's grieving, (fuck 'eml) 

.266. Cop killer, but tonight we get even, ha ha. 

.267. 


.268. For our next owning we bring you multiple law enforcement targets in the state 
.269. of New York, who has been on our crosshairs for some time due to their brutal 
.270. repression of Occupy Wall Street, We also want to bring attention to the 1971 
.271. riots at Attica where in response to the murder of George Jackson, convicts took 
.272. over the priso, demanding humane living conditions. It is in this same spirit of 
.273. cross-country solidarity that we attacked police targets in NY. 

.274. 


.275. We’re dropping the md5-hashed passwords and residential addresses for over 300 
.276. Police Chiefs in the state of New York. We are also sharing several private mail 
.277. spools of a few NY police chiefs. While most of the contents of these emails 
.278. involve boring day to day office work and blonde joke chain emails, there were 
.279. also treasure troves of embarrassing personal information as well as several 
.280. "For Official Use Only" and "Law Enforcement Sensitive" documents discussing 
.281. police methods to combat protesters, 

.282. 


.283. Subject: Mid Hudson Chiefs Fwd: Demonstrators 
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rand Jury Subpoena for 


subpoena : 


The following is a summary of the results of the 


The results have been printed out and are attached to 
this document for the file. 


Investigation on 01/11/2012 at San DiegO/ CA 
File# 288A-SD-73148 ' ( O 


Date dictated 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loa^d to your agency; 
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UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Precedence : ROUTINE 

To: San Diego 

From; San Diego 

CYl I 

Contact : SA | 

Approved By: | 


Drafted By; 


Case ID #; 288A-SD-73148 (Pending) 


Date; 01/26/2012 



Title; UNSUB (S); 

#ANTISEC; 


VICTIM; 


COMPUTER INTRUSION 

Synopsis; Close captioned investigation. 

Details: On November 18, 2011, retired California Depart ment of 

Justice Special Agent Si ipervi s o r I I advi s ed 

that he received text messages from his own Google telephone 
number indicating that he had been "owned" . 

On November 18, 2011, a YouTube video was posted with 
the title "iAntiSec Fuck FBI Friday V - Cybercrime Investigator 
Communications " from t he YouTube user account 

I The video was 6:03 long and stated the 
following information, which was also posted as text below the 
video : 


"Greetings Pirates, and welcome to another exciting #FuckFBIFriday release. 

As part of our ongoing effort to expose and humiliate our white hat enemies, we targeted a Special Agent Supervisor 
of the CA Department of Justice in charge o d ~I We are leaking over 38,000 private 

emails which contain detailed computer forensics techniques, investigation protocols as well as highly embarrassing 
personal information. We are confident these gifts will bring smiles to the faces of our black hat brothers and sisters 
(especially those who have been targeted by these scurvy dogs) while also making a mockery of "security 
professionals" who whore their "skills" to law enforcement to protect tyrannical corporativism and the status quo we 
aim to destroy. 






UNCLASSIFIED 



tJNCLASSIPIED 



To: San Diego From: San Diego 

Re: 288A-SD-73148, 01/26/2012 


We hijacked two gmail accounts belonging tcf 


I who has been a cop foi| ^ years, dumping his ormte 

email correspondence as well as se veral dozen voicemails and SMS text message lo gs. While just yesterday] | 

was having a private BBQ with his i [ friends, we were reviewing their 

detailed internal operation plans and proc edure d ocuments. We also couldn't overlook the boatloa ds of embarrass mg 
personal information about our cop friendl IWe lulzed as we listened to angry voicemails fronj 


n We turned on his google web history and watched him look up l I ~ L ^ 

] We also abused his google voice account, making sure! triends 


and family knew how hard he was owned. Pos sibly the most interesting content in his emails are the 
internal email list archives (2005-2011) which[ 


[ 


J 


]The information in these emails will prove essential to 


those who want to protect themselves from the techniques and procedures cyber crime investigators use to build 
cases. If you have ever been bust ed for computer crimes, you should check to see if your case is being discussed 
here. There are discussions aboud I 


These cybercrime investigators are supposed to be the cream of the crop, but we reveal the totality of their ignorance 
of all matters related to computer security. For months, we have owned several dozen white hat and law enforcement 
targets- getting in and out of whichever high profile government and corporate system we please and despite all the 
active FBI investigations and several billion dollars of funding, they have not been able to stop us or get anywhere 
near us. Even worse, they bust a few dozen people wh o are allegedly p art of an "anonymous computer hacking 
conspiracy" but who have only used kindergarten-level| this isn't even hacking, but a form of electronic 

civil disobedience. 


b6 

b7C 

b7E 


b7E 


We often hear these "professionals" preach about "full-disclosure," but we are sure these people are angrily sending 
out DMCA takedown notices and serving subpoenas as we speak. They call us criminals, script kiddies, and 
terrorists, but their entire livelihood depends on us, trying desperately to study our techniques and failing miserably 
at preventing future attacks. See we're cut from an entirely different kind of cloth. Corporate security professionals 
like Thomas Ryan and Aaron Barr think they’re doing something noble by "leaking" the public email discussion lists 
of Occupy Wall Street and profiling the "leaders" of Anonymous. Wannabe player haters drop shitty dox and leak 
partial chat logs about other hackers, doing free work for law enforcement. Then you got people like Peiter "Mudge" 
Zatko who back in the day used to be old school lOpht/cDc only now to sell out to DARPA going around to hacker 
conventions encouraging others to work for the feds. Let this be a warning to aspiring white hat "hacker" sellouts and 
police collaborators: stay out the game or get owned and exposed. You want to keep mass arresting and brutalizing 
the 99%? We'll have to keep owning your boxes and torrenting your mail spools, plastering your personal 
information all over teh internets. 


Hackers, join us and rise up against our common oppressors - the white hats, the 1%'s 'private' police, the corrupt 
banks and corporations and make 2011 the year of leaks and revolutions! 

We are Anti-Security, 

We are the 99% 

We do not forgive. 

We do not forget. 

Expect Us!" 


UNCLASSIFIED 
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San Diego From: San Diego 
288A-SD-73148, 01/26/2012 


A link was also provi ded on the YouTube page to the 
documents that were taken from ^account. The 


additionally, some of t 
account was posted at 


:ained within 



On November 30, 2011, California Department of Justice 
he FB I with a CD-ROM disc containing the files located 
These files are contained in a 1-A envelope to 
and are password protected with the following password 


responded to a Grand Jury 




lack of 


closed. 


Due to all victim infoimaation being destroyed and th e 


^San Diego requests that captioned investigation be 


UNCLASSIFIED 
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Date of transcription 01 / 26 / 2012 


I e-mail address 

~I was ilgfterviewed telephonicall y. 
being aavise(^^^^e identity of the interviewing Agent , \ 
volunteered tifee following information: 
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File Number 2^8 A"' "* ^ ^ S'. 


Field Office Acquiring Evidence . 
Serial # of Originating Document 
Date Received 1 — 

From 


(N 4 M 4 ai tSBlBBUlorimferviewee) 



(Address) 

t>6 

b 7 C 

(City and State) 


By SA 


To Be Returned D Yes 0^ No 

Receipt Given CD Yes 0^ No 

Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 

□ Yes Q^lo 

Federal Taxpayer Information (FTI) 

n Yes •ET No 


Title: UNSui!>(%V^ 

»AotTl S£c’. 

I | \i< ori^j 

coKvoTfii. iraruusioTiJ 

Reference: 'l^‘t3-*302 ll-lcflf zoll — ^ — 

(Communication Enclosing Material) 


Description: Original notes 
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statement regarding the hijacking of my personal accounts: 


On Friday 1 1-18-201 1 , at approximately 0700 hours I was getting in my car and began 


receiving text m essages on my phone from my own Gooale teleo 




This number is associated with my 


ihc 

_a 


one number of 
ccount of 


The messages stated that in essence, the senders had 
taken over my account and that they "owned" me. The messages were also directing 
me to a specific chat room (I already deleted the text) to contact them, othen/vise they 
were going to post my email and personal information ail over the Internet. I ignored 
them and they continued to harass me with incoming text messages. I checked via my 
smart Android based cell phone, and immediately noticed I no longer had access to my 
Google account, my Facebook account that was asso ciated with the same ema il 


address, and the yahoo account that was linked to my| ] The 

perpetrators continued to prod me to go to the chat room with threats of releasing the 
information, but I continued to ignore them. 


b6 

b7C 


When I arrived home at approximately 0730 hours, I went onto the Internet from what I 
believed to be a secure computer and via the specific providers websites followed their 
online protocols for recovering compromised accounts. It took approximately 1 hour, 
but I was successful in gaining access to all the compromised accounts and changed 
the passwords several times to prevent the intruders from following the same protocols. 
In the Google account, they harassed many of the contacts contained in my phone book 
with a variety of text messages. They posted personal emails from the email accounts 
around the Internet and made bold staterp ents about compromising a Department of 

Some of the email in my sent folder included 


JusticeT 


I They logged into my Facebook account and 

deleted most of my photos, changed configuration settings, posted numerous offensive 
comments and personal messages to various friends, as well as impersonated me in 
various chats. 


b6 
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I received a phone call fro m a Huffington Post reporter (didn’t get his name but seemed 
legitimate. ! b at approximately 1400 hours the same day. He was excited 

when he initially called, like he was at the forefront of a big breaking story. He asked if 
I wanted to comment on the compromise that happened to me and told me he learned 
of it from people in a chat room. It appears he thought I was going to be some high 
ranking manager of a computer crimes unit and there were going to be damning thin gs 
in the data they stole. I quickly deflated his enthusiasm as I told him ! I 

I and that whatever they got was personal, but not 
embarrassing and I was not going to give in to their threats and intimidation by 
contacting them. I further told him that in the overall scheme of things, I was really 
nobody and it was insignificant to terrorize me for their cause. 

Following my recovery of the accounts, the perpetrators texted me and said it was not 
over yet. They made a comment about how tough economic times were and I should 
beware of my financial status. I made a check of my assorted banking and credit 






account that I deal with online and discovered a fraudulent charge made th at morning to 
Ritz camera for appro ximately $896.95. The purchase was made with my[ 


[ 


and was sc heduled to ship to an old mailing address a 


r I contacted 


land they are cancelling the transaction 


and the account. There are no other know discrepancies at this time and have since 
place a credit block on my personal information. 


They continued to harass me via text and said they were releasing my telephone 
number to 150,000 followers on twitter, and hoped I wasn't busy. I received a few calls, 
but did only answered a few just to see what the callers had to say. Most just made 
ignorant comments and hung up. I disabled the gmail account, to avoid a backlog of 
voicemail as mv phone isl 

I I believe 

this tactic, along with not acknowledging them in the text or chat rooms frustrated them 
and kept them from calling or texting too much. There were a couple of texts from 

I that appeared to be sympathetic to me, wishing me well and hoping the 
hackers would be brought to justice. I ignored them as well, suspicious that the 
perpetrators were just testing to see if I was receiving their other harassment texts. 

I received only a few additional phone calls from mysterious numbers and harassment 
texts over the weekend. 


I desire prosecution. 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence ROUTINE 
To:- Cyber Division 


Date^ 10/08/2009 


ATT N:- Computer Intrusion' 0 
SSA 


nit #2 


From:- San Francisco 

Squad CY"2/San Uose RA 

Contact :- SA 


Approved By :- 
Drafted By: [ 


b6 

b7C 


] 


Case ID #:- 2SBA-STr^0^^ending) 
288A-SF-NEW-GJ (Rending) 

Title:- ANTT-SEC; 

UNSUB (S), et al; 

-IMAGESHACK VICTIM; 
COMRUTER INTRUSTON 


Synopsis:- To Open Case and SSibfiles. 



Details:- On October 8, 2^9, Special Agent 
with employees of IMAGEShAck located at 23X North Santa Cruz 
A venue^ Los Gatos. 'Cali^fornia ^39503^ to ‘discuss two recefit^ 
computer intrusions of IMAGESHACK servers. IMAGESHACK is a 
company which provides internet image hosting. 



met 


b6 

b7C 


IMAGESHACK advised SA l I that the first computer 
intrusion occurred on July 10/ 2009 at approximately 7 pm Raci.fic 
Standard Time (RST) . A group by the name of ANTT-SEC gained 
access to one of the company database servers. The server the 
hacker (s) accessed contained | 



able to I 


t The hacker (s) were also 


1 


] In addition, the hacker (s) posted a message on t 


hie 


internet which claims the ANTT-SEC is a movement dedicated to the 
eradication of fulT disclosure. Their message further explained 
they plan to achieve this "through the full and unrelenting, 
unmerciful elimination of all supporters of full-disclosure and 
the security industry in its present form. " 




0 ^ 
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A' 





. w 



To:- 

Re:- 


i ' 


San Trancisc 
288A-SF-NEW, 




From:- San 
10/08/2009 


Francisco 



IMAGESHACK advised this computer intrusion affected 
approximately SO million images and every user that was on their 
site at the time viewing -images . IMAGESHACK -is still not sure 
how the hacker got into their database but believe 
I I Aft-ftr f.his att.af.k. t-.hev went through tneir 


servers! 


On August 2, 2009, IMAGESHACK believes the same 
hacker (s) came back and gained access to their servers again. 
IMAGESHAC K has full and complete logs. It Is apparent the 
hacker (s) I I 


IMAGESHACK believes in the first com 
Julv 2009. the hacker (s) accessed one database 

puter intrusion in 



1 IlMAGESHACK believes the hacker (s)l \ 



IMAGESHACK estimates their losses at approximately 



$26,000. 
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It is requested that the following subfiles be opened:- 


Grand Jury 


SUB GJ 


It is requested that the new cas^ and subfiles be 
opened and assigned to SA 
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10/21/09 

12:08:07 



Title and Character of Case:- 


MTI SEC 


■FD-192 



ICMTPROl 
Page 1. 


Date Property Acquired:- Source from whi ch Property Acqui red:- 

IMAGBSHACK, C/O l ~l 263 N. SANTA CRUZ b6 

10/08/2009 263 N SANTA CRUZ AVB #100 ‘ b7c 

LOS GATOS CA 95030 

Anticipated Disposition;- Acquired Bv:- Case Agent: ' 


Description of Property:- Date Entered 

_1B 1 

SIX (6) hard drives 

-THREE (3) WESTERN DIGITAL S/N WMAP41239964 , S/N WMAKH'1252071 
AND S/N WMAKE'2153028 

-TWO (2) Hitachi s/n ckc4U9Se, s/n ckc5H4Mb 

-ONE(l) SAMSUNG S/N S09QJ1UL218644 
ONE(l) HITACHI 

Barcode:- E4189643 Location:- SJECR PRESSS 10/09/2009 


^ ^ O O TV ^ CT O /r 1 1 


Case Number:- 288A-SF-145486 
Owning Office:- SAN FRANCISCO 


ci8«A . ?f - f4S4s'^ , 11 } -<L*- ■ 



08/19/10 
1,9 : 29 : 55 




# 


FD-192 


ICMIPROl 
Page 1 


Title and Character of Case: 
ANTI SEC 


Date Property Acquired:- Source from which Property Acquired 

SV-RCFL 

08/19/2010 


-Anticipated Disposition 


Description of Property:- 
IB 2 



ONEd) CD LABELED SV-09«-0162 (DERIVATIVE EVIDENCE OF iBl) 


Barcode:- E4 18994 7 


Location:- SJECR 


PRESS3 


Date Entered 


08/19/2010 


[!\ A . I AO . Kt J 


Case Number:- 288A-SF-145486' 
Owning Office:- SAN FRANCISCO 


\mt 




A -- Sj' - ZC - \(b, 2. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of traoscfiptioo TQ/09/20Q9 

On October 8, 2009, | I was interviewed at 

his place of employment, -IMAGESHACK, located at '236 North San Cruz 
Avenue, Suite 100, Los Gatos, California, 95030, telephone number 
408-836-8579. Afteri-hainn. advised of the identity of the 
Interviewing agent, provided the following information;- 

On July 10, 2009 at approximately 7:00 p.ra., IMAGESHACK 

servers were hacked. The hacker (s) we re able to get into the 

ins 


I I Indicated the user 

This sever also contained 





|_ I -indicated IMAGESHACK does not collect or mainta in any credit bvc 

nerd i g fermaf-i on | I However. b7E 

Ut:et:ed t.hk hanker ( q ) would have had \ I 

advised that from that server, the 
nacKer(S) i I Ultimately, the 

hacker (s) I I 

I I advised this affected every 

oh VidWihg images and approximately 50 million images. 

He indicated IMAGESHACK user images we re repla ced with this 
propaganda message for several hours. I I said this caused 

quite a stir on the internet as it affected many website 
backgrounds as well. I l advised a group named ANTI-SEC claimed 

responsibility for the hack of IMAGESHACK on the internet. 


hack was a result of an 



1 He , 


ank. t-.hfi f.p»nhninal t-.nam at IMAGE 

SHACK 1 



back. 


On August 2, 2009, | | indicated the hacker (s) came 

He advised the staff at IMAGESHACK believes it was the same 


hacker (s) wf 
was able tol 


it appeared the 


Investigatkx) on 09/08/2009 
Fite # 288A-SF-145486":^ 
by SA 


Los Gatos, California 

D«e NA 


Thh cCtfvtuins ticithcf rc^omxncihS^rtions not ccaJCluSiOQS of the FBI It i$ the prof^rty of the FBI and i% loaned to youf agency; 

it aj^ iu contents are tiot to l?e di$trit>i^ed your agency. 
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288A-SF-145.486- 



$26,450. 


He stated the estimated company losses are approximately 


I provided one Computer Disk (CD) labeled IMAGESHACK 

ANTISEC which he did not want returned that contained copies of an 
overview of the hac k's, the ANTI -SEC jpg image posted to the 
servers/ email irom [~ -regarding the identity of the 

hacker (s), and chat logs from IMAGESHACK staff during the August 2, 


2009 attack. 


I I provided six. hard drives to S.A| | and 

signed an FD-.941 Consent to .Search Computer (s) form for these six 

hard drives. | |was also provided and signed an FD- 

597 United States Department of Justice, Federal Bureau of 
Investigation, Receipt For Property Received. The. fd-94l and FD-' 
597 and CD have been placed in a lA -envelope and' sent to the .file. 
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(Rcv.050J-200$) 

(S) 


CLmSSIIIlB BY 
RimSON: 1.4 (c> 
mchmssxwi OM: 0»-2:»-2fl3« 
BliTl: 


s 




mil H^DEBmfXQN COMTIlIlfflll 
miiiM IS infills sxFiEB Emmwfl 
raHERE smmi otheemise 
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FEDERAL BUREAU OF INVESTIGATION 


(S) 


(U) 

(U) 


Precedence: ROUTINE 
To: San Francisco 


Date: 11/03/2009 


Attn: SA 
SA 


:y-2 

, CY-3 


From: San Francisco 

Oakland RA 
Contact: 


1-2 and CY-3 


Approved By: 
Drafted By: 


Case ID # : I I 

(U) 288J-SF-141890 (Pending) 

(U) ^88A-SF-145486 ^3 


b6 

b7C 


bl 

b3 


Title:- 


DEATH IS COMING -FROM THE EAST; 
UNSUB (S) ; 

Cl /Cl - TNI I 


WORLD DEFACERS, 
UNSUB (S) ; 

CT - TNII 
00;SF 


(U) 



(U) 


Synopsis: 
Anti -Sec. 


Anti -Sec 
UNSUB(S) ; 

IMAGESHACK - VICTIM 

Identification of possible founding member of 


Di?rved-^irea^ ^ FBI ^ glgGG*^OOSOEl5 
Dedaseify'Onl 20341103“ 


fS) 

(U) 

(S) 

IS] 


Reference: 



;;^gi:'288A-SF-145486 Serial 1 




bl 

b3 




bl 

b3 


(S) 


(U) Open searches provide n o information that 

Anti -Sec hacked 



San Francisco divisioni I 

I A nacKing group 

named Anti-Sec gaine d access to one of the company's databa se 
servers and accessed I I 

L The hackers 

changed the server settings to redirect every image to a 
hacker logo. The hackers posted a message claiming that the 
Anti -Sec group is dedicated to the eradication of full 
disclosure by eliminating the cyber security industry. 
(288A-SF-145486, Serial : 1) 


b7E 
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(U) Anti'Sec claimed that a 


1 |. An identified 1 1 

1 

further stated that Anti -sec raoricatea 


the claim of l I 


White-Hat Hacker and Cyber Security Communities. Open source 
research r evealed that several large web hosting companies 
considered I _ I 

(800A-HQ-C1591622-NOADMIN, Serial : 20010) . 


b7E 


gT//PnTTn^ ar>f-i Hg H-i gmiciged in 


b7E 


(800A-HQ-C1591622-NOADMIN, Serial 20010) 


(S) 


S^)S^//NOFORn| 


bl 

b3 
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ET//N0F0RN/ 


P 


To:- 

Re: 


fian P-ranr-Haort Pr-rtm ffan Prannifinn 


LEAO(s} : 

Set Lead 1: (Info) 

SAN FRANCISCO 

AT SAN JOSE 
(U) Read and Clear. 


♦♦ 


S^0^^^/NOF^N>| 



in 

i I * 
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UNCLASSIFIED 

FEDERAL BUR^U OF INVESTIGATION 


^Precedence:; ROUTINE ' Date:: 11/10/200$ 

■To:- San Francisco 
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Title:- ANTI-SEC; 

UNSOB(S) ; 

iMAGESHACK --‘VICTIM; 
COMPUTER iNTRUSIOli 


From:- San .Francisco 

Squad CY2/Sa 

Contact: SA 

Approved By: 

Drafted By: 




Jose RA 


Case ID #:- 288A-SF-145486 (Pending 




Synopsis:- To Report US .Attorney Office concurrence for new case 
opening . 




.Details:: On October 3 , 2009 , Special Agent (sA) 
emailed Chief Assistant United State s Attorney .(AUSA ) ifor the 
Computer Intrusion and Hacking Unit,. r I regarding 

concurrence for new baptioned investig ation. The email contained 


a summary of ‘the case information. SA| ] was contacted 

telephonically and granted concurre nce regarding captioned 
investigation and advised that ^AUSA | |wouid be 

assigned the case. 


Attached and: made a part of this document is the email 
to AUSA I I 



UNCLASSIFIED 
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FEDERAL BUREAU OF INVESTIGATION 


’Precedence:- ROUTINE Date:- 11/13/2009 

To:- San Francisco 


From:- San Francisco 

Squad dY2/Sa n Jose RA 

Contact: SA ^ 


Approved By :- 


Drafted By:- 




Case ID #: 


288A-SF-14,5486 
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Title: ANTI-SEC; 

UNSUB (S), et al; 
■IMAGESHACK - VICTIM; 
COMROTER INTRUSTON 
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Synopsis:- To Claim Statistics. 


Details:- On September 16, 2009, Special Agent (SA)I 

telephonically spoke to the victim company, Imageshack, 
.regarding captioned matter and set a date to meet in person. 


On October 8, 2009, SA 


met with 


Imageshack and obtained the detailed ibiformation about the 
captioned computer intrusions. , Possible subject (s) have been 
Identified. 


of 


On November 13. 2009. SA 
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UNCLASSIFIED 
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To: San Francisco From:- San Francisco 
Re:- 288A-SF-14S486V ll/.l'3/2009 


Accomplishment Information :- 

Number:- 2 

Type:- CIP 2703(f) ORDER SERVED 
ITU:- CIP 

ITU:- :LIAIS0N WITH OTHER AGENCY 

Claimed By:-| 1 

SSN:- 

Name:- 

Squad CY2 


Number:- 2 

Type^ CIP SUBJECT IDENTIFIED 
ITU:- CIP 

ITU:- LIAISON WITH OTHER AGENCY 

Claimed Byt , 

SSN:- 

Name :■ | 

Squad:- CY2 
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Number:- 2 

Type^ CIP VICTIM CONTACTED/ INTERVIEWED 
ITU:- AGENT INTERVIEW 
-ITU:- CIP 

ITU :- INDIVI DUAL/NON- INFORMANT 
ITU:- .LIAISON WITH OTHER AGENCY 

Claimed By:-, , 

SSN:- 

Name: 

Squad :-^ CY2 


♦♦ 


UNCLASSIFIED 
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FEDERAL BUREAU OF INVESTIGATION 


DateoftrwwiptwJ , .12/09;/20Q9 , 

On December 8. 2QQ9. Special Aaentf 
a facsimile fromL 


received 
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aforementioned facsimile had been attached and is . made: a part of, 
this, document.; 


Investigation on 12/08/2009 

4 t . Campbell, California 

Fiie#.288A-SF-i45486'i^'^ .D«c4i««e4. NA 



- 





ThH documcftt ooxrtiifis neither recommerhi^tioos nor e^clvsioo$ of the FBI. It is the pre^rty of the FBI *a4 is I<««e4 to yow agency; 
at an4 its contents are not to be distributed ov^idc yw ^ency, 
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li: 

FEDERAL BUREAU OF INVESTIGATION 


Date ef transcription 03/02/2010 

On January 23, 2010, Special Agent fSA) I I 

rrar;<a-i vipH a y^Qrvoncta a fa^<;Snr>S t-r» a I I 



The above referenced letter had been attached and Is made 
a part of this document. 


Investigation on 01/23/2010 at Campbell, California (via facsimile) 


File # 288A--SF-14548e - \h- 

sa| ~| 


D«tc dictated 
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NA 





This docttrttcftt toftttitts neither rccorrrnicridjftiorts not conclusions of the FBI. is the pfc^ity of the FBI *n4 is k«tned to ywr t|cocy; 
it «n4 Us contents sre not to he disuihuted outside your agency, 




FD-542(Rev,03-23-20(») 


UNCLASSIFIED < 

FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date:- OX/14 72010 

To:- San Francisco 


;Frora:- San Francisco 

Squad . CT 2 / S an_jlQS£-BA_ 
Contact: SA 


Approved By: 
Drafted' By: 


Case ID #:- 288A-SF-145486- (Pending^xj^ 


b6 
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-Title:- ANTI-SEC; 

■ UNSUB (S), et al; 
JMAGESHACK - VICTIM; 
COMPUTER -iNTRUSTbN 


Synopsis:- To Claim Statistics. 

Details:- On January 12. 2010. Special Agent (SA) I I 


On October 8, 2009, Imageshack provided SA | 1 Vith six 

’hard drives and conseht 'to search those hard drives. 


UNCLASSIFIED 



UNCLASSIFIED 






To:- San Francisco From:- San Francisco 
•Re:; 288A-SF-145486,. 01/14/2010 


Accomplishment Information :- 


Number:- 1 

Type:- CIR 2703(f) ORDER SERVED 
ITU:- CIP 

TTU:- LIATSON WITH, OTHER AGENCY 

Claimed Byi 

SSN:' 

Name :• | 

Squad:- CY2 


Number:- ‘8 

Type:- -CIP VICTIM CONTACTED/INTERVTEWED 
ITU:- consensual SEARCH 


Claimed By:- 
SSN :-■ 
Name :- 
SqUad::' 


■CY2" 
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UNCLASSIFIED 


2 



FD-3C!2(Rev. 10-«-95) 


• • 

iL‘ 

FEDERAL BUREAU OF INVESTIGATION 


jDaic of trmcriiition 



Oh April 27. 2012. Specia l Agent | | returned 

six hard, drives to| ^ | at his place of employment 

IMAGESHACK, 236 Santa Cruz Avenue^ Los Gatos, California, 95030. 
copy of the signed FD-597 United States Department of Justice 
Federal 'bureau of Investigation Receipt :for Property 
Received/Returned/Released/Seized had been placed in a lA envelop 


and sent to the file. 


A 
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This ^ocunacDit tonttm odthct rcconMncn^atioas c<?nclusk>tts ot the FBI Dt is the pre^rty of the FBI stn4 is loaned to yout agency; 
it and its contents are not to he distributed outside yew agency. 



(Rev. 05-01-200$) 


• 4 

UNCLASSIFIED 

FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 04/27/2012 

To: San Francisco 
From: San Francisco 



Title; ANTl-SEC; 

UNSUB (S), et al; 
IMAGESHACK - VICTIM 
COMPUTER INTRUSION 


Synopsis: To Close Captioned Case. 

Details: Assistant ^ United States Attorney (AUSA) 
Special Agent 


and 


SA 


(SA) f have discussed captioned 

ihvestigati^5n_and. its status on numerous occasions. On March 16, 
2012, AUSa I , I inq uired via email if caiptioned investigation could 
be closed. 


advised that since there are no good subject 

internet protocol (IP) addresses and no good follow-up leads or 
information from current sources, captioned investigation should be 
closed. 


The evidence obtained in this investigation did not derive 
enough probable cause to result in the identifi cation of a subject for 
a prosecUteable offense. On April 18, 2012, SA | | received a 

letter from the United States Attorney's Office stating that their 
office has closed the investigation. The abovementioned letter has 
been attached and is made a part of this document. 


On April 27, 2012, SA 


returned the hard drives 


provided by Imageshack as evidence in captioned case back to the 
victim company . 


It is recommended that captioned case be closed and that th^ 
evidence collected on captioned case be destroyed and/or returned 

UNCLASSIFIED 


I 


2 - 





V 


• . • 

UNCLASSIFIED 

■To:- Sain Fraincisco From:- San Francisco 
Re: 288A-SF-i45486, 04/27/2012 


pursuant tO’ FBI policy. There: are no pending leads dr further 
investigatidri. required: dn captioned case.: 


♦♦ 


UNCLASSIFIED 


2. 




U.S. Departm^l^f Justice 

lUnited States Attorney 
Northern District of California 


Special Agent 

ISO Almaden Boulevard, Suite 900 
San Jose; California ' 9SIJS 

April 18, 2012 

DD: (408) S35-5061 
FAX:(408) $35^5066 

Federal Bureau of Investigation 

1919 S. Bascom Avenue, Suite 400 


b6 

b7C 

Campbell, CA 95008 




RE: ImaseShack Intrusion 


Dear Special ‘Agent 


This letter.is to confirm that my office has closed the investigation into the ImageShack 
•intrusion by a group known as Anti-Sec. Based on our conversations, you have conducted an 
exhaustive investigation and have been unable to identify the individual responsible for the 
intrusion. If you find new evidence, please resubriiit the case for prosecution. 

I appreciate all of your wo rk on the case. Ple ase do hot hesitate to contact me if you have 
any questions. l ean be reached aJ 


VeryJruly yours, 

MEIilNDAHAAG 
United States Attorney 


Assistant United States Attorney 



I 




FEDERAL BUREAU OF INVESTIGATION 
FOI/PA 

DELETED PAGE INFORMATION SHEET 
FOI/PA# 1204913-0 


Total 

Deleted 

Page (s ) 

Page 

6 - 

- b6; 

b7C; b7E 

Page 

7 - 

^ b6; 

b7C; b7E 

Page 

8 - 

- b7E ; 


Page 

17 

- b6; 

b7C; 

Page 

18 

- b6; 

b7C; 

Page 

19 

- b6; 

b7C; 

Page 

20 

~ b6; 

b7C; 

Page 

21 

- b6; 

b7C; 

Page 

22 

- b6; 

b7C; 

Page 

23 

- b6; 

b7C; 

Page 

24 

- b6; 

b7C; 

Page 

25 

- b6; 

b7C; 

Page 

26 

- b6; 

b7C; 

Page 

27 

- b6; 

b7C; 

Page 

28 

- b6; 

b7C; 

Page 

29 

- b6; 

b7C; 

Page 

30 

- b6; 

b7C; 

Page 

31 

- b6; 

b7C; 

Page 

32 

- b6; 

b7C; 

Page 

33 

~ b6; 

b7C; 

Page 

34 

~ b6; 

b7C; 

Page 

35 

- b6; 

b7C; 

Page 

36 

- b6; 

b7C; 

Page 

37 

- b6; 

b7C; 

Page 

38 

- b6; 

b7C; 

Page 

39 

- b6; 

b7C; 

Page 

40 

- b6; 

b7C; 

Page 

41 

- b6; 

b7C; 

Page 

43 

- b6; 

b7C; 


XXXXXXXXXXXXXXXXXXXXXXXX 
X Deleted Page(s) X 
X No Duplication Fee X 
X For this Page X 
XXXXXXXXXXXXXXXXXXXXXXXX 



Case ID: 288A-SF-145486-1A 


lA Envelope 


ORIGINAL NOTES RE INTERVIEW OF| | 

FD-597 RECEIPT FOR PROPERTY; FD-941 CONSENT TO SEARCH 
COMPUTERS; ONE CD WITH PRINTED COPIES 



SILICON VALLEY RCFL REPORT OF EXAMINATION DATED 11/17/2009; ! 
AND 08/09/2010 AND RETURN TO AGENCY RECEIPT DATED 08/19/2010 ! 
(NO REFERENCE SERIAL) ! 


! SF 


-ORIGINAL PACKAGE COPY FD192 (CHAINS OF CUSTODY) lA'D 
-ORIGINAL 1B2 ENCLOSED 


! SF 


-ORIGINAL PACKAGE COPY FD-192 OF IBl (EVIDENCE RETURNED) 
-COPY OF A SIGNED FD-597 


! SF 


FD-597 RECEIPT FOR PROPERTY RETURNED TO 
IMAGESHACK ON 4/27/12 (REF SERIAL 14) 


I 





•U.s, 6P0: 2004-307-714/90013 


FD-597 (Rev 8-11-94) 


File # 


UNITED STATES DEPARTMENT OF JUSTICE 
FEDERAL BUREAU OF INVESTIGATION 
Receipt for Property Received/Returned/Released/Seized 


On (date) 


(Name) 

(Street Address) 
(City) 


item(s) listed below were: 
JSy^ Received From 

□ Returned To 

□ Released To 

□ Seized 



Description of Item(s): 




FD-941 (2-26-01) 


CONSENT TO SEARCH COMPUTER(S) 


I, 


have been asked by Special Agents of the 


Federal Bureau of Investigation (FBI) to permit a complete search by the FBI or its designees of any and all computers, 
any electronic and/or optical data storage and/or retrieval system or medium, and any related computer peripherals, 
described below: 

^ (4prg-oP^Nigr 


[ 


rPTT Make MndH Serial Niimh^ nf 


Storage nr Retrieval Media rnmniiter Perinherak 


_b6 

b7C 

b7E 


and located at 


jWhich I own, possess, 


control, and/or have access to, for any evidence of a crime or other violation of the law. The required passwords, logins, 
and/or specific directions for computer entry are as follows: 


I have been advised of my right to refuse to consent to this search, and I give permission for this search, freely 
and voluntarily, and not as the result of threats or promises of any kind. 



b6 

b7C 


Location 



July 10^^ Hack 


On July 10th, at approximately 7 pm PST, ImageShack’s services were compromised by a hacking 
group named anti-sec. 

The first user complaint came in at 6:59pm pst. 

Anti-sec gained access to one of our database servers. 


Server named: 



They posted this message after the attach on multiple security threads: 


This message linked back to the antisec's website: 


On Thu, 23 Jul 2009 we received an email ffom| 

provided some information on his site which was also hacked by the same group. 


which he 


b6 
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email_from 

email_ffom 

attachment: 


Anti-Sec info 

The group we believe has at least two members 


some website registered under 



August 2 Hack 


On August 2 early in the morning about 12:50am pst we were compromised again. They were unable to 
effect users as we stop them in time. We have chat logs of our employee included. 


Chat logs: 


b6 
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Estimated company loses 



/ l_l__l 

\__ \ / \ __\ I / // __ \_/ \ 

/ __ \l I \ I I I / / \ W A \ 

C / 1 /__l l__l / >\ >\ 

\/ \/ V V V 


> 


Proudly presents... 


(-) 


1/ / 

1 1 \ 1/ 

1/ 

_ \' 

/ __1 

1 \ 

1/ __l 


1 1 1 1 1 1 I C-I 1 c_l 

1 


\__ \ 

1 1 1 c_l 1 

C-I < 

\_\ 

l_l_l l_l l_l\__,_l\__. 

l\. 

.__l 

1 / 

l_l l_l\__. 

_l\ l_l 


__/ I 
I / 


Anti -sec. We're a movement dedicated to the eradication of 
full-disclosure. We wanted to give everyone an image of what we're 
all 

about. 

Full-disclosure is the disclosure of exploits publicly - anywhere. 
The 

security industry uses full-disclosure to profit and develop 
scare-tactics to convince people into buying their firewalls, 
anti-virus software, and auditing services. 

Meanwhile, script kiddies copy and paste these exploits and compile 
them, ready to strike any and all vulnerable servers they can get a 

hold 

of. If whitehats were truly about security this stuff would not be 
published, not even exploits with silly edits to make them slightly 
unusable. 

As an added bonus, if publication wasn't enough, these exploits are 
mirrored and distributed widely across the Internet with a nice 

little 

advertisement embedded in them for the crew or website which first 


exposed the vulnerability to the public. 

It's about money. While the world is difficult to change, and money 

will 

certainly continue to be a very important in the eyes of many, our 
battle is that of the removal of full-disclosure for the purpose of 
making it harder for the security industry to exploit its 
consequences. 

It is our goal that, through mayhem and the destruction of all 
exploitive and detrimental communities, companies, and individuals, 
full-disclosure will be abandoned and the security industry will be 
forced to reform. 

How do we plan to achieve this? Through the full and unrelenting, 
unmerciful elimination of all supporters of full-disclosure 
and the security industry in its present form. If you own a 

security 

blog, an exploit publication website or you distribute any 
exploits. . . 

"you are a target and you will be rm'd. Only a matter of time." 

This isn't like before. This time everyone and everything is 

getting 

owned . 


Signed: The Anti -sec Movement 

"No images were harmed in the making of this... image. 


b7E 



Replacing images... 


b7E 


If you think that we oppose your website, our advise is to pack it up and 
shut it down, because we're coming for you. 


- anti-sec. 
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FD-340 (Rev. 4-11-03) ’ 

File Number ^ 


Field Office Acquiring Evidence 

Serial # of Originating Document 

Date Received S | \:xo j p 


fcr ^ S^., (Jkf^ :.(^ 


(Name of ContribuTor/Interviewee) 


fhr/.er-TJ^D 


_C|g. j— , pk>tC ( 

^ (City i^nd State) 


(Address) 

/and State 




By 






To Be Returned □ Yes 

□-No 

Receipt Given D Yes 

P^o 

Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 

□ Yes 

Federal Taxpayer Information (FTI) 

P^No 

n Yes 

P-No 


Title: 


I Reference: 


PT +7 *r"r§^^ ' 

'X^ v* :v»r;^ 


(Comtnunication Enclosing Material) 
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Description: D Original notes re interview of 

5^S ) I A- \^£o^ (2e,oa~^ op ^:,4.tu 

Ml. _ tK r . 1 t 


>LJj...A ^ ,.y. A j y .^., 

A'tJ\^.4 n 1)"7 ^ <r)oi)^p)Z7 J 



I 

18-1 (Rw^^'5-26-2007) 

e- ' 



Silicon Valley Regional 
Computer Forensic Laboratory 


4600 Bohannon Drive 
Suite 200 
Menlo Park, CA 94025 



REPORT OF EXAMINATION 


To; San Francisco 

San Jose RA 

saI 


Date: August 9, 2010 

Case ID No.: 288A-SF-145486 

Lab No.: SV-09-0162 


Reference: Communication (Request for Service) dated October 20, 2009 
Imaging Report dated November 17, 2009 

Ref. No.: N/A 

Title: ANTISEC UNSUBS ; (V) IMAGESHACK 


b6 
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Date specimen received: October 21 , 2009 


Specimens: 


b6 
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Request: 


On October 20, 2009, Special Agent 


Federal Bureau of 


Investigation, requested that the above noted specimens, property of ImageShack, be 
examined pursuant to a signed consent form. She requested that the following items 
be searched for, identified (if present), documented, and reported on by the SVRCFL: 


1) Hacking rootkits and logs 

Summary of Examination: 

Attached and made part of this report is Imaging Report dated November 17, 2009. 
While this report addresses the examination processes, the attached Imaging Report 
addresses the imaging of the submitted evidence. 


Enclosures: 0 
Page 1 of 3 


For Official Use Only 





f 


2: 

3 : 


These files were exported to a digital report. The other hard drives provided did 
not contain anything that appeared to be relevant. 


Details of Examination: 


SA | ] provided thq 


Legal authority 

for the examination was provided as a signed consent form that was reviewed by the 
examiner prior to starting the examination. 


m 


performed: 


used the examination image for review. The following processes 


were 


1; 

2; 


b6 
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Derivative Evidence: 


Disposition of Evidence; 


1 ) 

2 ) 


All original items. 


lo be returned to submitting agency. 


288A-SF-145486 
SV-09-0162 
Page 2 of 3 


For Official Use Only 



b7E 


y;' 


3) 1 I 

until its released to the investigator with this report. 

4) Special handling instructions include: 

a. All files contained on this DVD have the potential to contain viruses and other 
malicious code exported from the examined computer media. Therefore, this 
DVD should not be viewed on any networked computer OR any computer 
connected to the Internet. It is recommended this DVD only be viewed on a 
standalone workstation designed for the purpose of evidence review. Please 
consult your systems administrator for assistance and guidance. 

b. In certain investigations, files and information containing contraband such as 
pornographic images and trade secrets may have been discovered and copied onto 
this DVD. This can also include pornographic and obscene images of children. 
Extraordinary care must be taken to safeguard this material and properly secure it 
when not being used for investigative or legal purposes. The SVRCFL 
recommends this DVD be secured in appropriate storage, such as an evidence 
facility, when not being reviewed by the investigator. 

c. File attributes such as time/date stamps are dependent on several factors such as 
computer date/time settings and time zones. Where possible and feasible, 
date/time attributes have been preserved and details can be foimd in the electronic 
report contained herein. 

d. THIS DVD SHOULD NOT BE DUPLICATED or DISSEMINATED to parties 
outside of the requesting law enforcement agency or prosecutor's office without 
first consulting with Silicon Valley RCFL. 

e. This DVD is intended primarily for law enforcement and prosecution use. It is not 
recommended that this DVD work product be used for evidentiary hearings, trials, 
or other official proceedings. If any contents of this DVD are needed for a legal 
proceeding, the Silicon Valley RCFL should be contacted so that the relevant 
items can be provided in a form suitable for these purposes. 


Examiner: 


Silicon Valley Regional Computer Forensic Lab 
Computer Analysis Response Team 


b6 

b7C 


288A-SF-145486 
SV-09-0162 
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For Official Use Only 
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Silicon Valley Regional 
Computer Forensic Laboratory 


4600 Bohannon Drive 
Suite 200 
Menlo Park, CA 94025 



REPORT OF EXAMINATION 


To: 


San Francisco 
San Jose RA 
S.A.I 


Date: November 17, 2009 

b6 

CaseIDNo.:288A-SF-145486 b?^ 

Lab No.: SV-09-0162 


Reference: Communication (Request for Service) dated October 20, 2009 
Ref. No.: N/A 


Title: Image Shack 


Date specimens received: October 2 1 , 2009 


Specimens: 


Request: 


b6 
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Refer to the final Report of Examination for information on services requested. This 
report relates to the imaging processes only. 

Summary of Examination: 

Digital evidence media items were imaged to media to be retained as archives, and to 
staging media for future forensic examination by an assigned forensic examiner. 


Enclosures: 0 
Page 1 of 3 


For Official Use Only 



Details of Examination: 




Prior to conducting any forensic process, I reviewed the legal authority, presented as 
a "Consent to Search" form. 

Upon submission to the SVRCL, each submitted item was inventoried. As part of the 
inventory process, each item was assigned a unique SVRCFL bar code, and was 
entered into the SVRCFL evidence system. Where appropriate, make, model, and 
serial number for each imaged item was recorded, and each item was digitally 
photographed. 

To preserve the original evidence and minimize any risk of damage to the original, an 
exact copy of the user-accessible data located on the evidentiary items was created 
onto staging media. (The exact copy will hereafter be referred to as an image.) The 
images were created using approved and appropriate forensic imaging software to 
write to forensically clean staging media prepared for use in an examination. Unless 
otherwise noted, the original evidence was write-protected using a hardware-write 
protection device to prevent any unintentional or accidental destruction or 
modification of the original evidence. An archive copy was also made using 
approved and appropriate software. 

The staging media will be used in the examination phase to further satisfy the request, 
while the archive copy will be retained in the SVRCFL evidence control room in 
order to preserve the evidence should it be required in the future for authentication or 
court processes. 


b7E 


I All the original evidence was returned to the SVRCFL evidence control 

room. 

The following processes were performed during imaging of the original evidence: 

Physical Examination of Evidentiary items 
Write Protect Media 

Hardware Geometry and System Information 
Create Image 


b7E 


WK 

SV-09-0162 
Page 2 of 3 


For Official Use Only 



Verification 


St 


Items imaged: 
1.1 
2 . 

3. 

4. 

5. 

6 . 


Derivative Evidence (DE) generated during the course of this examination includes 
the fol lowing: 



b7E 


Stagi ng media used during the course of this examination includes the following: 

i.r 


Disposition of Evidence: 


All original evidence items returned to the SVRCFL evidence control room. All DE 
items will be retained in the SVRCFL evidence control room for a period of five 
years in order to preserve the evidence in the event additional forensic processes or 
legal proceedings require its use. After this time, the DE will be returned to the 
requestor’s agency for disposition. 


This imaging of this case is complete. The staging media will be given to an 
examiner for additional forensic processing. 


Examiner: 


Silicon Valley Regional Compter Forensics Lab 
Computer Analysis Response Team 
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Silicon Valley RCFL Return to Agency Evidence Receipt 


Regional Computer Forensics Laboratory 

4600 Bohannon Drive Suite 200, Menlo Park CA 94025 
650-289-3000 FAX; 650-289-3050 



SV-09-0162 


Evidence Details 

Total number of evidence items processed on this receipt: 9 


Description: 

Media Container: Accordion Folder 

Storage Location: [Undetermined] 

Make: 

Model: 

Serial Number: 

Case ID / Lab number: 

SV-09-0162 

Agency Case Number: 

288A-SF-145486 

Lab Designation I Designation Expl.: 

Not Examined (NE), [No designation 
explanation] 

Intake Container / Seal: 

None / None 

ECF Container / Seal: 

Plastic Bag / Heat Seal 

Intake Damage: 

[No damage recorded] 

Tracking Number: 



Description: 

Hard Drive: HDD 

Storage Location: [Undetermined] 

■ MaKg; , 

Model: 

n I 

1 1 


Case ID / Lab number: 

I I 

SV-09-0162 

Agency Case Number: 

Lab Designation / Designation Expl.: 

288A-SF-145486 

Questioned (Q), [No designation explanation] 

Intake Packaging: 

ECF Container / Seal / Packaging: 

[Not recorded] 

[Not recorded] 

Intake Damage: 


[No damage recorded] 

Tracking Number: 



Description: 

Hard Drive: HDD 

Storage Location: [Undetermined] 

1 Maker 





Case ID i Lab number: 

SV-09-0162 

Agency Case Number: 

288A-SF-1 45486 

Lab Designation / Designation Expl.: 
Questioned (Q), [No designation explanation] 

intake Packaging: 

[Not recorded] 

ECF Container / Seal / Packaging: 

[Not recorded] 

Intake Damage: 

[No damage recorded] 

Tracking Number: 



Property / Evidence Receipt 


bate/time — 

Released By 

Received By 

Date / Time 
06/19/2010 

12:30 PM 

1 f SVRCFL (Phone: 000-000-0000) * 




‘Indicates the Witness acl 


3 

lO 



Silicon Valley RCFL Return to Agency Evidence Receipt 


Regional Computer Forensics Laboratory 

4600 Bohannon Drive Suite 200, Menlo Park CA 94025 
650-289-3000 FAX: 650-289-3050 


Evidence Details 

Total number of evidence items processed on this receipt: 9 


SV-09-0162 


Description: 

Hard Drive: HDD 

Storage Location: [Undetermined] 


Model: 

I 

I 

Serial Number: 

Case Id I Lab number: 

SV-09-0162 

Agency case Number: 

288A-SF-1 46486 

Lab Designation / Designation Expl.: 
Questioned (Q), [No designation explanation] 

Intake Packaging: 

[Not recorded] 

EOF Container / Seal / Packaging; 

[Not recorded] 

intake Damage: 

[No damage recorded] 

Tracking Number: 



Description: 

Hard Drive: HDD 

Storage Location: [Undetermined] 


Model: 




Case iu / Lab number: 

SV-09-0162 

Agency Case Number: 

288A-SF-1 45486 

Lab Designation / Designation ExpL: 
Questioned (Q), [No designation explanation] 

Intake Packaging: 

[Not recorded] 

ECF Container / Seal / Packaging: 

[Not recorded] 

Intake Damage: 

[No damage recorded] 

Tracking Number: 



Description: 

Hard Drive: HDD 

Storage Location: [Undetermined] 



1 

I 

Serial Number: 

Case ID / Lab number: 

1 1 

SV-09-0162 

Agency Case Number: 

Lab Designation / Designation ExpL: 

288A-SF-1 45486 

Questioned (Q), [No designation explanation] 

Intake Packaging: 

ECF (Container / Seal / Packaging: 

[Not recorded] 

[Not recorded] 

intake Damage: 


[No damage recorded] 

Tracking Number: 



Property / Evidence Receipt 



indicates the Witness acted as 


page 2 c f 3 

Document Generation Date: 08/19/2010 




^ Silicon Valley RCFL Return to Agency Evidence Receipt 


Regional Computer Forensics Laboratory 

4600 Bohannon Drive Suite 200, Menlo Park CA 94025 
650-289-3000 FAX: 650-289-3050 


Evidence Details 

Total number of evidence Items processed on this receipt: 9 




Description: 

Hard Drive: HDD 

Storage Location: [Undetermined] 








Case ID / Lab number: 

SV-09-0162 

Agency Case Number: 

288A-SF-1 45486 

Lab Designation / Designation Expl.; 
Questioned (Q), [No designation explanation] 

intake Packaging: 

[Not recorded] 

ECF Container i Seal / Packaging: 

[Not recorded] 

Intake Damage: 

[No damage recorded] 

Tracking Number: 


Description: 

Media Container: plastic bag 

Storage Location: [Undetermined] 

Make: 

Model: 

Serial Number: 

Case ID 1 Lab number: 

SV-09-0162 

Agency Case Number: 

[No Agency Case Number] 

Lab Designation / Designation Expl.: 

Not Examined (NE), [No designation 
expianation] 

Intake Container / Seal: 

None / None 

ECF Container / Seal: 

Paper Bag / Heat Seal 

Intake Damage: 

[No damage recorded] 

Tracking Number: 



Description: 

DVD: digital report 

Storage Location: [Undetermined] 

Make: 

Model: 

Serial Number: 

Case Id / Lab number: 

SV-09-0162 

Agency Case Number: 

[No Agency Case Number] 

Lab Designation / Designation Expl.: 

Derivative Evidence (DE), [No designation 
explanation] 

Intake Packaging: 

[Not recorded] 

ECF Container / Seal / Packaging: 

[Not recorded] 

Intake Damage: 

[No damage recorded] 

Tracking Number: 



Property / Evidence Receipt 


Date/Time 

Released By 

Received by 

Date /Time 
08/19/2010 

1230 PM 

Name/Agency 

Jann Hayes , SVRCFL (Phone: 000-000^00) * 

Name/Agency 

Melanie Adams , FBI (Phone: 

408-998-5633) 


b6 

b7C 


‘Indicates the Witness acteJ 


r 

bio 









08/19/10 

19:29:55 FD-192 

Title and Character of Case: 

ANTI SEC 


Date Property Acquired: 
08/19/2010 


Source from which Property Acquired: 
SV-RCFL 


ICMIPROl 
Page 1 


Anticipated Disposition: Acquired By: Case Agent : 

Description of Property: Date Entered 

IB 2 

ONE(l) CD LABELED SV-09-0162 (DERIVATIVE EVIDENCE OF IBl) 

Barcode: E4189947 Location: SJECR PRESS3 08/19/2010 


b6 

b7C 




/454^'S- !(b- Z 


Case Number: 
Owning Office: 


288A-SF-145486 
SAN FRANCISCO 



FD-1004 

Revised 

9-16-2009 


FEDERAL BUREAU OF INVESTIGATION 

EVroENCE CHAIN-OF-CUSTODY 


Evidence Type: □ General □ Drug □ Firearm/Weapon 

^ CART □ Valuable □ Firearm/Other 

Special Handling Instructions 


Initial Receipt 


Date and 
Time 

□ Batteries □ Biohazard □ FGJ 

□ HAZMAT □ Latents □ Refrigerate 

□ Req. Charging □ None 

□ Other 

Signa^ 




Printec 



Relinquished Custody 

Date and 
Time 

Accepted Custody 

1 

Date and 
Time 




1)0 
530^ 

Signature: 



mm 


Printed Nam 



Reasoni-T^ 

Reason: 

• Relinquished Custody 

t ^ 

Date and 
Time 




Accepted Custody 

1 

Date and 
Time 

Signature: 



lo itj- 





Printed Nam 




/ rv > jT 





Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date and 
Time 

Signature: 


Signature: 


Printed Name: 

Printed Name: 

Reason: 

Reason: 

Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date and 
Time 

Signature: 


Signature: 


Printed Name: 

Printed Name: 

Reason: 

Reason: 

Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date and 
Time 

Signature: 


Signature: 


Printed Name: 

Printed Name: 

Reason: 

Reason: 


Firearms Certification: 

Printed Name: Signature: 


Case ID; - Sp- ( 4548' ^IB: 




Date: 


Barcode: 



























































FD-340b(Rev.4-U-03) 


File Number , 


Field Office Acquiring Evidence oj _ 

Serial # of Originating Document , 

Date Received ^ j 3D / ^ 0} ^ . 

.From I I2p ^ I 

(Name of Contributor/Intcrvicwcc) 







To Be Returned CD Yes □ Nq 

Receipt Given D Yes CD No 

'6rand Jury Material « Disseminate Only Pursuant to Rule 6 (e) 
...Federal Rules of Criminal Procedure 

\ □ Yes P No 

Federal Taxpayer Tnformatioii.(FTI) 

□ Yes ' □ No 

Title: ■ S6G^ 


Reference; 


(Communication Enclosing Material)' 


Description; CD Original notes re interview: of 

-Poia^rvoL OarhxP^ QOkA^ 





'*"l0/'2l/09 

12:08:07 


FD-192 


ICMIPROl 
Page 1 


Title and Character of Case : 


ANTI SEC 


Date Property Acquired: Source from whi ch Property Acqui red: 

IMAGESHACK, C/O I I 263 N. SANTA CRUZ 

10/08/2009 263 N SANTA CRUZ AVE #100 

LOS GATOS CA 95030 



Case Number: 288A-SF-145486 
Owning Office: SAN FRANCISCO 








Firearms Certification: 

Printed Name: Signature: Date: 

■ Case ID: £p - IZj- ^ IB: Barcode: I'S /| 



EVIDENCE CHAIN-OF-CUSTODY 


Continuation Page 



Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date and 
Time 

Signati 






Signature: 







Printed Name: 

Printed Name: 

✓ 



Reason: 

1 Reason: 


Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date and 
Time 

Signature: 


Signature: 


Printed Name: 

Printed Name: ' 

Reason: 

Reason: 

' Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date and 
Time 

Signature: 


Signature: 


Printed Name: 

Printed Name: 

Reason: ■ 

Reason: 

Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date and 
Time 

Signature: 


Signature: 


Printed Name: 

Printed Name: 

Reason: 

Reason: 

Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date and 
Time 

Signature: 


Signature: 

• 

Printed Name: 

Printed Name: 

Reason: 

Reason: 

Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date and 
Time 

Signature: 

- 

Signature: 

• 

Printed Name: 

Printed Name: 

Reason: ' 

Reason: 


Case ID: 


I^S4^ 


IB: 


Barcode: 





EVIDENCE cm 


Continuation Page 


Relinquished Custody 


Signature: 


Printed Name: 


Relinquished Custody 


Signature: 


Printed Name: 


Relinquished Custody 


Signature: 


Printed Name: 


Relinquished Custody 


Signature: 


Printed Name: 


Reason: 


RelinquislTe^ Custody 


Date and 
Time 



Date and 
Time 





Signature: 


Printed Name: 


Reason: 


Relinquished Custody 


Signature: 


Printed Name: 



Date and 
Time 



-OF-CUSTODY 



Accepted Custody 

Date and 
Time 

Signature: 


Printed Name: 

Reason: 

Accepted Custody 

Date and 
Time 

Signature: 


Printed Name: 

Reason: 

Accepted Custody 

Date and 
Time 

Signature: 


Printed Name: 

Reason: 

Accepted Custbdy 

Date and 
Time 

Signature: 


Printed Name: 

Reason: 



Accepted Custody 

“Date^and” 

Time 

Signature: 


Printed Name: 

Reason: 

Accepted Custody 

Date and 
Time 

Signature: 

j 

Printed Name: 

Reason: 


Barcode: 
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FD-340(Rev.4-M-03) 
File Number 




Field Office Acquiring Evidence 
Serial # of Originating Document 
Date Received 


)cu: 

4 j>7 /Xog 


3 


From 


Federal Bureau of Investigation 
1919 8. Bascom Avenue 
Suite # 400 
Campbell, CA 95008 


(City and State) 


By 




To Be Returned □ Yes 
Receipt Given □ Yes 


Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 

□ Yes Grl^ 

Federal Taxpayer Information (FTI) 

□; Yes JZJ-Nb 

Title: 


b6 

b7C 


Reference: 


(Communication Enclosing Material) 




Description: □ Original notes re interview of 
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,^(R5V.'fr\‘‘-31-2003) 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 


To: Cyber Division 


Date: 10/08/2009 

ATT N: Computer Intrusion Un it #2 
SSA I I 


From: San Francisco 

Squad CY-2/S an Jose RA 

Contact: SA I I 

b6 

Approved By: 

7 - 

Drafted By : 

— . 

Case ID #: 288A-SF-NEW- (Pending)^l . 

288A-SF-NEW-GJ (Pending) ^ j 

Title: ANTI-SEC; 

UNSUB (S), et al; 

IMAGESHACK - VICTIM; 

COMPUTER INTRUSION 

Synopsis: To Open’ Case and subfiles. 

Details: On October 8, 2009 , Special Agent (SA) met 

with employees of IMAGESHACK located at 236 North Santa Cruz 
Avenue, Los Gatos, California, 95030, to discuss two recent 
computer intrusions of IMAGESHACK servers. IMAGESHACK is a 
company which provides internet image hosting. 

IMAGESHACK advised SA that the first computer 

intrusion occurred on July 10, 2009 at approximately 7 pm Pacific 
Standard Time (PST) . A group by the name of ANTI-SEC gained 
access to one of t he company database servers. The serve r the 
hacker (s) ar.r.pRsp.H I I f or 

IMAGESHACK customers to include | I 


I I. In addition, the hacker (s) postea a message on me 

internet which claims the ANTI-SEC is a movement dedicated to the 
eradication of full disclosure. Their message further explained 
they plan to achieve this "through the full and unrelenting, 
unmerciful elimination of all supporters of full-disclosure and 
the security industry in its present form." 


Dic^ 









To: San Francisdjll^ From: San Francisco 

Re: 288A-SF-NEW, 10/08/2009 


IMAGESHACK advised this computer intrusion affected 
approximately 50 million images and every user that was on their 
site at tha tima viftwina imanfts. TMAGF.fiHACK ia .st.ill not sure ^ 

b6 

b7C 

b7E 


On August 2 , 2009, IMAGESHACK believes the same 
hacker (s) came back and gained access to their servers again. 

IMAGESHAC K has full and complete logs. It is apparent the 

hacker (s) I I t>6 

I b7C 

T b7E 


IMAGESHACK believes in the first computer ini-rn.giinn in 
July 2009. the hacker (s) accessed one database which I I 



the Aug ust attack, IMAGESHACK believes the hacker (s) only were 


aKIo -hn [ 


$26,000. 


IMAGESHACK estimates their losses at approximately 


It is requested that the following subfiles be opened: 

Grand Jury SUB GJ 

It is requested that the new c ase and subfiles be 
opened and assigned to SaI 


b6 

b7C 

b7E 


b6 

b7C 


♦♦ 


2 



U.S. Department of Justice 
Federal Bureau of Investigation 



In Reply, Please Refer to 

FileNo. 288A-SF-145486-GJ 


450 Golden Gate Ave. 

San Francisco, CA 94102 
(415) 553-7400 

Nov.ember 10, 2009 — 


Honorable Joseph P. Russoniello 
United States Attorney 
Northern District of California 
450 Golden Gate Avenue 
San Francisco, California 94102 


Attention: | | 

Assistant United States Attorney 

ANT I -SEC; 

UNSUB (S), et al; 
IMAGESHACK - VICTIM; 
COMPUTER INTRUSION 


Dear Sir: 


Pursuant to the above captioned investigation, the 
Federal Bureau of Investigation (FBI) requests that the below 
listed individuals be placed on the Federal Grand Jury 6E list, 
in as much as they may require access to grand jury information 
during the course of the investigation: 


NAME AGENCY 

I FBI 
FBI 
FBI 
FBI 
FBI 
FBI 
FBI 
FBI 
FBI 
FBI 
FBI 
FBI 


POSITION 

Special Agent 

Special Agent 

Special Agent 

Special Agent 

Special Agent 

Special Agent 

Special Agent 

Supervisory Special Agent 

Intelligence Analyst 

SST 

Evidence Control Technician 
Evidence Control Technician 


Z.gpS-4. SfCiqs-4 ^- Cj- P- 



Should you have any questi ons regarding t his matter, 


please do not hesitate to contact SA 
Resident Agency, telephone number 


San Jose 


Sincerely, 


Stephanie Douglas 
Special Agent in Charge 


By: I I 

Supervisory Special Agent 



FD-302 (Rev. 10-6-95J 




- 1 - 

FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 12/14/2009 


GR2^ iJURY MATERIAL - DISSEMINATE PURSUANT TO RULE 6(e) 


On December 14. 2009. Special Aaent (SA) | 

served a Grand Jury subpoena via facsimile to 1 



1 The subooena 1 1 




The file copy of the Grand Jury Subpoena has been 



attached and is made a part of this document. 


b3 

b6 

b7C 



Investigation on 12/14/2009 

at Campbell, 

California 

(via facsimile) , 


File# 288A-SF-145486-GJ; 


Date dictated' NA 


by SA 




c 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents, are not to be distributed outside yoiir agency. 


b6 

b7C 



.AO no (Rev. 12/89) Subpoena to Testify Befd^Wand Jury 


©nitei) ^tateg Bisitrirt Court 

NORTHE]^' DISTRICT OF CALIFOIGm 


TO: 

SUBPOENA TO TESTIFY 
BEFORE GRAND JURY 

,<^llRPnFMAFnR- 


YOU ARE HEREBY COMMANDED to appear and testify before the Grand Jury of the United States, Distinct 
Court at the place, date and time specified below. 


PLACE 

COURTROOM 

United States District Court 

280 South First Street 

As directed by the court 

San Jose, CA95113 

DATE AND TIME 


January 6, 2010 at 9:30 a.m. 


YOU ARE ALSO COMMANDED to bring with you the following document(s) or object(s):* 


Please see attachment. 

Compliance with this subpoena will be deerned satisfactory when you provide all the materials to the agent serving this 
subpoena and no appearance will be necessary. 


13 Please see additional information on reverse. 

This subpoena shall remain in effect until you are 
behalf of the court. 


lepart by the court or by an officer acting on 



U.S.MAGISTRATEJUDGE OR CLERK OF COURT / 
RICHARD W. WIEKING j 


DVkTE 

i December 1 1 , 2009 

(By) Deputy Clerk 7 

This subpoena is issued on 
application of the United States of 

America 

JOSEPH P. RUSSONIELLO 

United States Attorney 

NATWE/€®DRKaAT^HONE NUMBE;?23ff MSISTANT U.S. ATTORNEY 
kssistant UpvArnSnexf 

1 50 Almaden Blvd., Suite 900 /S // O' 

San Jose. CA 951131 1 

FBI Special Agent] 


If not applicable, enter "none”. 



AOno (Rev. 1 2/89) Subpoena to Testify BefG(^and Jury 



’’Fees and mileage need not be tendered to the witness upon service of a subpoena Issued on behalf of the United States or an officer or agency 
thereof (Rule 45(c), Federal Rules of Civil Procedure; Rule 17(d), Federal Rules of Criminal Procedure) or on behalf of certain Indigent parties and 
criminal defendants who are unable to pay such costs (28 USC 1825, Rule 1 7(b) Federal Rules of Criminal Procedure)". 


b3 

b6 

b7C 


( 2 ) 



FD-448 (Rev. 6-2-97) 




FBI FACSIMILE 
COVER SHEET 


PRECEDENCE CLASSIFICATION 


n Immediate 
r~l Priority 
[X] Routine 


[D Top Secret 
□ Secret 
n Confidential 
dl Sensitive 
[X] Unclassified 


Time Transmitted: 

Sender's Initials: J 

Number of Pages: 4 

(including cover sheet) 


To: ^ ^ 

Name of Office 


Facsimile Number: 


Attn: I I 

Name Room Telephone 

From: FBI San Francisco - San Jose Office 

Name of Office 

Subject: Preservation Request 


Date: 12/14/2009 


b3 

b6 

b7C 


Special Handling Instructions: 


Originator's Name: Special Agent [ 

Originator's Facsimile Number: 

Approved: 

Brief Description of Communication Faxed: 


Telephone: 


WARNING 

Information attached to the cover sheet is U.S. Government Property, If you are not the intended recipient of this 
information, disclosure, reproduction, distribution, or use of this information is prohibited (18.USC, § 641). Please notify the 
originator or the local FBI Office immediately to arrange for proper disposition. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 12/14 72009 

GRAND JURY MATERIAL - DISSEMINATE PURSUANT TO RULE 6(e) 

On December 14, 2009, Special Agent (SA) I 
served a Grand Jury subpoena via facsimile to F I 


b3 

b6 

b7C 


The file copy of the 
attached and is made a part of 


Grand Jury Subpoena has been 
this document. 





Investigation on 12/14/2009 

at 

Campbell, California 


(via facsimile) 

File# 288A-SF-145486-GJ 

74 

Date dictated 

NA 

by SA 



b6 

b7C 




This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 



.A01 1 0 (Rev. 1 2/89) Subpoena to Testify BefojlHRnd Jury 




NORTHERN 


niteb States ®isitrirt Court 

DISTRICT OF CALIFORNIA 


SUBPOENA TO TESTIFY 
BEFORE GRAND JURY 

SUBPOENA FOR: 


YOU ARE HEREBY COMMANDED to appear and testify before the Grand Jury of the- United States District 
Court at the place, date and time specified below. 


PLACE 

COURTROOM 

United States District Court 

280 South First Street 

As directed by the court 

San. Jose, CA95113 

DATE AND TIME 


January 6, 2010 at 9:30 a.m. 


YOU ARE ALSO COMMANDED to bring with you the following document(s) or object(s):* 


Please see attachrnent. 

Compliance with this subpoena will be deemed satisfactory when you provide all the materials to the agent serving this 
subpoena and no appearance will be necessary. 


0 Please see additional information on reverse. 

This subpoena shall remain in effect until you ar§^ 
behalf of the court. 


U.S. MAGISTRATE JUDGE OR CLERK OF COURT 
RICHARD W. WIEKING 

(By) Deputy Clerk 


This subpoena is. issued on 
application of the United States of 
America 

JOSEPH P. RUSSONIELLO 
United States Attorney 



3 ^^te>depart by the court or by an officer acting on 


December 11, 2009 


HONE NUMBER OF ASSISTANT U.S. ATTORNEY 


jAssistant U.S./AttcOTe 


150 Almaden Blvd., Snitp 900 
San Jose, CA 951^ 

FBI Special Agent] 


If not applicable, enter "none”. 







AOl 1 0 (Rev. 1 2/89) Subpoena to Testify BefJHirand Jury 






(2) "Fees and mileage need not be tendered to the witness upon service of a subpoena issued on behalf of the United States or an officer or agency 
thereof (Rule 45(c), Federal Rules of Civil Procedure; Rule 17(d), Federal Rules of Criminal Procedure) or on behalf of certain indigent parties and 
criminal defendants who are unable to pay such costs (28 USC 1825, Rule 1 7(b) Federal Rules of Criminal Procedure)". 



Fb-448'<Rev. 6-2-97) 
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FBI FACSIMILE 
COVER SHEET 


PRECEDENCE CLASSIFICATION 


CH Immediate 
CH Priority 
[X) Routine 


□ Top Secret 
O Secret 

□ Confidential 

□ Sensitive 
El Unclassified 


Time Transmitted: 

Sender's Initials: I I 

Number of Pages: 3 

(including cover sheet) 


To; 


Date: 12/14/2009 

Name of Of 

'ice 


Facsimile Number: 


Attn: I I 

Name Room Telephone 

b3 

b6 

From: FBI San Francisco ~ San Jose Office b7c 

Name of Office 


Subject: 


Special Handling Instructions: 



Approved: 

Brief Description of Communication Faxed: 


WARNING 

Information attached to the cover sheet is U.S, Government Property, If you are not the intended recipient of this 
information, disclosure, reproduction, distribution, or use of this information is prohibited (18,USC, § 641). Please notify the 
originator or the local FBI Office immediately to arrange for proper disposition. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 12 729/2009 


GRAND JURY MATERIAL - DISSEMINATE PURSUANT TO RULE 6(e) 


On December 23, 2009, Special Agent (SA) 
received a response to a Federal Grand Jury Subpoena via tacsimile 


from r 


Tha ra.qnon.qa inclndftd the following 


b3 

b6 

b7C 



The above referenced response provided by l_ 
has been attached and is made a part of this document. 


Investigation on 


12/23/2009 at Campbell, California 


(via facsimile) 


File # 288A-SF-145486x6^y^ 
by 


Date dictated NA 


SA 


b6 

b7C 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 




5 12/23/2009 12:28 PM 
12/14/2009 

FD‘448 (Rev. 6-2-97) 


18002234893 
16:13 4085581^ 


14085581096 
FBI CYBER 


D5 

PAGE 01/04 



FBI FACSIMILE 
COVER SHEET 


PRECEDENCE CLASSIFICATION 


□ Immediate 
D Priority 
|Xl Routine 


□ Top Secret 

□ Secret 

D Confidential 

□ Sensitive 
IS Unclassified 


Time Transmitted: 

Sender's Initials: I 
Number of Pages : 3 

(including cover sheet) 


To; 


] 


Name of Office 


Facsimile Number; 
Attn: 


Name 


Room 


Telephone 


From; FBI San Francisco - San Jose Office 

Name of Office 


Subject: J 


Date; 12/14/2009 


b3 

b6 

b7C 


Special Handling Instructions: 


Originator's Name: Special Agent 
Originator's Facsimile Number: ^ 

Approved: 

Brief Description of Communication Faxed 


WARNING 

Information attached to the cover sheet is U.S. Government Property. If you are not the intended recipient of this 
information, disclosure, reproduction, distribution, or use of this information is prohibited (18-USC, § 641). Please notify the 
originator or the local FBI Office immediately to arrange for nroocr dispositinn ' - — 


Telephone; 



FD-302 (Rev. 10-6-95) 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 01/ 06/2010 

GRAND JURY MATERIAL - DISSEMINATE PURSUANT TO RULE 6(e) 


On January 6, 2010, Special Agent[ 
a response via facsimile to the abovementior 
from I 


received 


The information, which was provided in paper format, 
included the following information: 




Investigation on 01/06/2010 at Campbell, California 


Date dictated N/A 


File# 288A-SF-145486-GJ ✓ 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 






FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 03/ 05/2010 


GRAND JURY MATERIAL - DISSEMINATE PURSUANT TO RULE 6(e) 



Investigation on 03/05/2010 at Campbell^ California (via facsimile) 

File# 2 8 8A— SF~14 54 8 6— G J Date dictated NA 

by SA 


b6 

b7C 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 





'V 





.A01 1 0 (Rev. 1 2/89) Subpoena to Testify Before Grand Jury 



GJ 09-1 2009R02026 


SHniteit States; 3B(s(tri£t Court 

NORTHERN DISTRICT OF CALIFORNIA 



SUBPOENA TO TESTIFY 
BEFORE GRAND JURY 


SUBPOENA FOR: 


YOU ARE HEREBY COMMANDED to appear and testify before the Grand Jury of the United States District, 
Court at the place, date and time specified below. 


PLACE 

COURTROOM 

“■ b3 

United States District Court 

As directed by the court 

b6 

280 South First Street 


San Jose, CA 951 1 3 

DATE AND TIME 



March 17, 2010 at 9:30 am 



YOU ARE ALSO COMMANDED to bring with you the following document(s) or object(s):* 


-See Attachment- 


Compliance with this subpoena will be deemed satisfactory when you provide all the materials to the agent serving this 
subpoena and no appearance will be necessary. 


0 Please see additional information on reverse. 

This subpoena shall remain in effect until you an 
behalf of the court. 


U.S. MAGISTRATE JUDGE OR CLERK OF COURT 
RICHARD W. WIEKING 

(by) Deputy Clerk 


This subpoena is issued on 
application of the United States of 
America 

JOSEPH P. RUSSONIELLO 
United States Attorney 



epart by the court or by an officer acting on 


March 3, 2010 


NATWEfi^BBKfitAWiy PHONE NUMBER OF ASSISTANT U.S^ATTORNEY 

] Assistant U&c^ftorn 

150 Almaden Blvd., Suite 900 v 1/ 

San Jose, CA 951 13 1 
Special Agenf 



1 


If not applicable, enter "none". 





A01 1 0 (Rev. 1 2/89) Subpoena to Testify Before Grand Jury 



Procedure. 

‘Tees and mileage need not be tendered to the witness upon service of a subpoena issued on behalf of the United States or an officer or agency 
thereof (Rule 45(c); Federal Rules of Civil Procedure; Rule 17(d), Federal Rules of Criminal Procedure) or on behalf of certain indigent parties and 
criminal defendants who are unable to pay such costs (28 USC 1 825, Rule 1 7(b) Federal Rules of Criminal Procedure)”. 


( 2 ) 



FD-302(Rev. 10-6-95) 


FEDERAL BUREAU OF INVESTIGATION 


Dale of transcription 03/3 1/2010 

GRAND JURY MATERIAL - DISSEMINATE PURSUANT TO RULE 6(e) 


On March 29, 2 010, Special Agent | | received 

via U.S. Postal service a response to a Grand Jury subpoena from 





Investigation on 03/29/2010 at Campbell, California 


File# 288A-SF-145486-GJ 


Date dictated NA 



This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 







FD-302 (Rev. 10-6-95) 



-1 - 

FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 11/22 /2 010 


GRAND JURY MATERIAL - DISSEMINATE PURSUANT TO RULE 6(e) 

b3 
b6 
b7C 


A copy of the abovementioned Grand Jury Subpoena has been 
attached and is made a part of this document. 


On November 22, 2010, Special Agent 
served a Grand Jury subpoena via facsimile to 



Investigation on 11/22/2010 at Campbell, California (via facsimile) 

File # 2 88A— SF — 1454 8 6 — GJ Date dictated NA 

by SA 


b6 

b7C 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 



GJ 09«I 2009R02026 





.AO 1 1 0 (Rev, 1 2/89) Subpoena to Testify Before Grand Jury 

Unttel) S>tatcS iBtStrict Court 

NORTHERN DISTRICT OF CALIFORNIA 



SUBPOENA TO TESTIFY 
BEFORE GRAND JURY 

SUBPOENA FOR: 


YOU ARE HEREBY COMMANDED to appear and testify before the Grand Jury of the United States District 
Court at the place, date and time specified below. 


b3 

b6 


PLACE 

COURTROOM 

United States District Court 

As directed by the court 

280 South First Street 


San Jose, CA 95113 

DATE AND TIME 


December 8, 2010 at 9:30 am 


YOU ARE ALSO COMMANDED to bring with you the following document(s) or object(s);* 


-See Attachment- 


Compiiance with this subpoena wiii be deemed satisfactory when you provide ail the materials to the agent serving this 
subpoena. No appearance will be necessary. 


0 Please see additional information on reverse. 


This subpoena shall remain in effect until you ar§ 
behalf of the court. 


iepart by the court or by an officer acting on 


U.S; MAGISTRATE JUDGE OR CLERK OF COURT / 
RICHARD W. WIEKING f 


I»TE 

I November 22, 201 0 

(By) Deputy Clerk \ \ / 

This subpoena Is issued on 
application of the United States of 

America 

MELINDA HAAG, 

United States Attorney 

NATHP<TOnRF;«u<<A!P«>PHnNF Ml iMRFR OF a<;<;i<;tant u ^ attornfy 

1 lAssistarUlT/Q. Attornev. 

150 Almaden Blvd., Suite 9Clb / 

San Jose, CA 95113 (408) 53^0(61 

Special Agent Melanie Adams^^l (408) 369-8900 


If not applicable, enter “none". 



C ' ’ • 
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"Fees and mileage need not be tendered to the witness upon service of a subpoena issued on behalf of the United States or an officer or agency 
thereof (Rule 4S(c), Federal Rules .of Civil Procedure; Rule 17(d), Federal Rules of Criminal Procedure) or on behalf of certain Indigent parties and 
criminal defendants who are unable to pay such costs (28 USC 1825, Rule 17(b) Federal Rules of Criminal Procedure)", 
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UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Precedence : ROUTINE 

To : Cyber 


Date: 1/17/2012 

Attn; SSaI 

ecu- 2 

Attn; Victim-Witness Coordinator 


From; San Antonio 
Cyber C-4 
Contact; SA 


Approved By; 
Drafted By; 




b6 

b7C 


T 


Case ID #; 288A-SA-^ffiW (Pending) 

188B-SA-58304-K (Pending) 

, ( 

Title; | 


3 ^ 


] ANTI SEC; 


TEXAS COMMISSION ON JAIL STANDARDS ( TCJS . STATE . TX . US ) 
VICTIM 

COMPUTER INTRUSIONS - CRIMINAL MATTERS 
Synopsis; To open case and GJ subfile. 

Details; On 11/08/2011, a CHS provided writer with a C D 
containinql I 



b6 

b7C 

b7D 

b7E 


LZ 

ACS and 


searches on the term 



is an FD-302 of an 2006 interview of 
residence ini I in which he [ 


b6 

b7C 


The information provided the following: 


Name : 


OPEN&ASSIGJJ'CS^E / ^ 

UNCLASSIFI^ass/Alpha;__M^-^^^ y- > 

Case Agent: I- j 


SRC Code! 

CPI Codes 

Assess I (Pull 

IDENTITY TH: 

DATE; i-n- V 







UNCLASSIFIED 


To: Cyber From: San Antonio 

Re: 288A-SA-NEW, lllll2012 



Telephone : 
Associate 
Addresses : 
Businesses : none 


It is requested that the case and Grand Jury subfile be 

opened . 



UNCLASSIFIED 


2 



UNCLASSIFIED 


# 

To: Cyber From: San -Antonio 

Re: 288A-SA-NEW, 1/17/2012 



LEAD(s) ; 

Set Lead 1: (Info) 

CYBER 

AT CCU2. DC 

For information only. 


Set Lead 2: (Info) 

SAN ANTONIO 

AT SAN ANTONIO. TEXAS 

To advise Victim-Witness Coordinator of case 
initiation. 

♦♦ • 


UNCLASSIFIED 


3 




lA Envelope 



Case ID: 288A-SA-63452 


OTHER SEALED ORDER 





1 


I 



FD-340 (Rev. 4-1 1-03) 
File Number 




Field Office Acquiring Evidence _ 
Serial # of Originating Document . 





<4- 1- '2-PI2. 


From 




OTHER SEALED ORDER 


(Name of Contributor/Interviewee) 


(Address) ’ 






^ity and State) 

BV 5>t-| 

To Be Returned □ Yes C3^No 

Receipt Given CD Yes !3^ No 

Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 


□ Yes 

Federal Taxpayer Information (FTI) 

□ Yes 


Title: 


0^ No 



b6 

b7C 


Reference: ^ 

(Communication Enclosing Material) 

OTHER SEALED ORDER 


Dfisc rmfion; H Original notes re interview of 





DocLab Note 


ITEMS (S) 
CANNOT 
BE 

SCANNED 

DESCRIPTION 

CO 


■'/ 



< 1 . V 

} 

o 

ro.340 {Rev. 4-11-03) 

rv > 

FileNumber ^ /n 

1 

Field Office AcQuIrbiEEvfdenee 1 


Serial# of Originating Docnnienf' ! 

61 

Date Received 1 0/^ ( 0/ IZ. ' 

From 


(Name of Contributor/biterviewee) 


(Addiest) 


By 


5A 


fCitv and State't 


To Be Returned D Yes IET No 

Receipt Given D Yes IZT No 

Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 

Federal Rules of Criminal Procedure y 

□ Yes □ No 

Federal Taxpayer Information (FTI) / 

□ Yes □ No 


Title; 


b6 

b7C 


Reference: 


. c;- 


(Communication Encbsing Material) 


De scription; 


;• Origii 


Original notes re interview o f 





FBI SAN ANTONIO 

CYBER SQUAD C-4 


FAX TRANSMITTAL SHEET 



Date: 


Number of Pages: 

4- 

(Including Fax Sheet) 



To: 





Fax Number: 1 




From: ' 




Contact Number : Office 

n 


- 


Fax: 


Reference: 


OTHER 





UNCLASSIFIED 


t 


FD-542 (Rev. 03-23-2009) 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 02/09/2012 

To : San Antonio 


From: San Antonio 



Title; | 

ANTI SEC; 


TEXAS COMMISSION ON JAIL STANDARDS (TCJS . STATE . TX. US) - 
VICTIM 

COMPUTER INTRUSIONS - CRIMINAL MATTERS 


Synopsis: To claim statistical 

accomplishment . 


Detailst On 02/09/2012. SA 

served a 1 

b6 

J Ivia facsimile. 

The letter requested the ^ 

b7C 


UNCLASSIFIED 

i 


b6 ^ 



UNCLASSIFIED 



To: San Antonio From: San Antonio 

Re: 288A-SA-63452, 02/09/2012 


Accomplishment Information: 
Number : 1 

Type: CIP 2703(f) ORDER SERVED 

ITU: CIP 

Claimed Byj 

SSN:' 

Name 

Squadl C-4 


b6 

b7C 


♦♦ 


UNCLASSIFIED 


2 





:J||L 


INFORMATION NEEDED FRD^M AGENT FOR COMPLETION OF CRIMIjSRL OPENING FORMS: 
(Complete one form for each defendant) 


NAME & AKA'S OF SUBJECT: 


Antisec 


ADDRESS 


SEX: 
SSN: [ 


M DOB: 

1 

i 

1 



ID#: 

ARREST DATE: n/a 


COUNTRY OF CITIZENSHIP: USA 

IMMIGRANT STATUS : NON-RESIDENT / ONDOCOMENTED / LEGAL PERMANENT RESIDENT / VALID VISA 

IS THIS A SINGLE AGENCY, SHARED AGENCY OR TASK FORCE CASE? LIST ALL: 

AGENT/ AGENCY : FBI AGENCY CASE # : 288A-SA-63452 

Any other agency involved: 

AGENT/ AGENCY : AGENCY CASE # : 

ANTICIPATED CHARGES: Title 18 USC 1030. Title 18 USC 2261 A (2) (A) 

(LIST LEAD CHARGE FIRST) 


ESTIMATED DOLLAR LOSS : none 


IN WHAT COUNTY OR COUNTIES DID THE CRIME OCCUR? 


County 


DOES SUBJECT HAVE COUNSEL? Unknown 

IF YES, CIRCLE ONE: FEDERAL DEFENDER / APPOINTED / RETAINED / PRO SE 

And LIST COUNSEL'S NAME AND ADDRESS : N/A 


IF THIS IS A BANK FRAUD CASE, IS THERE A PROGRAM AGENCY INVOLVED? 

(i.e.. Comptroller of the Currency, FDIC, etc.) IF SO, LIST AGENCY AND 
THEIR FILE NUMB E R-: n/a ! ^ 


ARE THERE ANY VICTIMS IN THIS CASE? Yes IF SO. WHOM? Texas 
Commission on Jail Standards website at www.tcjs.tx.us 


IS THIS A SENSITIVE CASE? .Nq 

GIVE SHORT SYNOPSIS OF CASE: Subject of case is involved in computer hacking 
with the Anonymous group. Subject conducted unauthorized activity against 
www.tcis.tx.us as part of a computer intrusion attack against the site. 



V 



(Rev. 0I-OI-20O8) 


UNCLASSIFIED 

FEDERAL BUREAU OF INVESTICATION 


Precedence: PRIORITY 

To : San Antonio 

From: San Antonio 

Cyber C-4 
Contact: SA 


Date: 02/27/2012 


Attn: SIA 


Approved By: 
Drafted By: 




Case ID #: 288A-SA-63452 
Title: 


(Pending) 




b6 

b7C 


ANTI SEC; 

TEXAS COMMISSION ON JAIL STANDARDS (TCJS . STATE . TX .US) 
VICTIM 

COMPUTER INTRUSIONS - CRIMINAL MATTERS 


Synopsis : 

Request SOS 


assistance on 

Details : 

Writer requests SOS 



assistance due 

to the overwhelming amount of time - sensitive data being org vided 
by a CHS . This data often contains 


1 


J 


] 


Due to the amount, and frequency, of the data, it is not 
possible to provide timely updates to the affected FBI field 
offices and law enforcement agencies while also addressing 
current CIP National Security and CIP Criminal case load. 


assistance will 

and c onducting onli ne 


jjne 


It is anticipated that SOS 

consist of reading email, watching videos, ana cot 

research regarding CIP Criminal hacktivism. SOs[_ 

assistance is requested to assist C-4 Cyber in mitigating 
hacktivism threats which are presently ongoing in FBI San 
Antonio's AOR and in other FBI Field Office AORs. CHS reporting 
is arriving daily, but becomes stale if not utilized immediately 
to assist in preventing or responding to CIP Criminal Hacktivism 
threats. The duration of the captioned case is unknown and will 
be commensurate with the operational life of the CHS. 


Without SOSi 


assistance, there is a 


substantial risk of losing valuable information being provided by 


b7D 


b6 

b7C 


UNCLASSIFIED 



UNCLASSIFIED 


To: San Antonio From: San Antonio 

Re: 288A-SA-63452, 02/27/2012 


the CHS into CIP Criminal Hacktivism threats and the ability to 
mitigate these threats in a timely manner through prevention of 
attacks or mitigation of known or attempted intrusions. 


UNCLASSIFIED 


2 


UNCLASSIFIED 


To: San Antonio From: San Antonio 

Re: 288A-SA-63452, 02/27/2012 


LEAD(s) : 


Set Lead 1: (Action) 

SAN ANTONIO 


matter. 

♦♦ 


AT SAN ANTONIO. TEXAS 


Please assign SOS 


to captioned 


b6 

b7C 


UNCLASSIFIED 


3 



UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Precedence : ROUTINE 

To : San Antonio 

From: San Antonio 

Cyber/C-4 
Contact: SA 


Date: 02/20/2012 


Approved By: 
Drafted By: 


z 


Case ID #: 288A-SA-63452 (Pending) ^ 

Title: 


i 


b6 

b7C 


ANT I SEC; 


TEXAS COMMISSION ON JAIL STANDARDS (TCJS . STATE . TX. US) - 
VICTIM 

COMPUTER INTRUSIONS - CRIMINAL MATTERS 

Synopsis: To claim statistical accomplishment. 

Details: To date, during the course of this investigation, 

writer has accomplished numerous achievements. 

The owners of www. Icso . ora and www.pbso. ora were notified 
of trespasser activity against their sites. 


The sub j of: M-i(a -i H rrah -i 

identified through 


1 


iAias 


T 


b6 

b7C 

b7D 


UNCLASSIFIED 



UNCLASSIFIED 


To: San Antonio From: San Antonio 

Re: 288A-SA-63452, 02/09/2012 


Accomplishment Information: 


Number : 2 

Type: CIP VICTIM CONTACTED/ INTERVIEWED 

ITU: CIP 

Claimed By a 


SSN: 
Name : 
Squad :' 




Number : 1 

Type: CIP SUBJECT IDENTIFIED 

ITU: CIP 

Claimed By: 


SSN: 
Name : 
Squad :' 


C-4 


Number : 1 

Type: CIP INFORMANT /ASSET DEVELOPED 

ITU: CIP 

Claimed By^ 

SSN: 

Name : 

Squad*? 




Number : 1 

Type: CIP CONSENSUAL MONITORING CONDUCTED 

ITU: CIP 

Claimed By: 


SSN: 
Name : 
Squad : 


U-4 


♦♦ 


UNCLASSIFIED 



UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE 

FEDERAL BUREAU OF INVESTIGATION 


Precedence ; ROUTINE 
To; San Francisco 


From; San Antonio 
Cyber/C-4 
Contact; SA 


Date; 04/11/2012 
Attn; San Jose RA 


SA 


Approved By; 
Drafted By: 




b6 

b7C 


Case ID #; 288A-SA-63452 (Pending) 

Title ; 


U 


ANTI SEC; 


TEXAS COMMISSION ON JAIL STANDARDS (TCJS . STATE . TX. US) - 
VICTIM 

. COMPUTER INTRUSIONS - CRIMINAL MATTERS 
Synopsis; Request location of subject of captioned case. 
En closure (s) ; Enc losed for San Jose are two recent photographs 

of r 


Details ; 


l a CHS provided writer with a CD 



b6 

b7C 

b7D 

b7E 


UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE 





UNCLASSIFIED 

San Francisco From: San Antonio 
288A-SA-63452, 04/11/2012 


Writer requests confirmation of the location of 


IS believed 


I the subject of this captioned case. 

to reside ini 


The subject's full name is 

I possible cellular telephone number 

’ ’’ress: I I 


This residence is | 

primary residence . Other possible residents at 


that location may be 


appears to be currently 


Perti nent to this lead is the f 
subject of 


|. See case 288A-AT -99196 for further information 

Please be aware that I I mav be I 


UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE 










UNCLASSIFIED 



To: San Francisco From: San Antonio 

Re: 288A-SA-63452, 04/11/2012 


LEAD(s) : 


Set Lead 1 : (Action) 

SAN FRANCISCO 

AT SAN JOSE. CALIFORNIA 


C 


Please determine the current residence of 
and d etermine whether he currently is 


Please include information on any electronic 


equipment that may be observed in subject's possession. 


♦♦ 


b6 

b7C 


DNCLASSIFIED//LAW ENFORCEMENT SENSITIVE 


3 







Precedence : ROUTINE 


Date: 04/20/2012 


To : Cyber 


Attn: 


SSAL 

CCU-2. 

ssa|_ 

CCU-1 


San Antonio Attn: CI- 

SSA 

CT-4 

From: San Antonio 

Cyber/C-4 

Contact: SA ^ 



TEXAS COMMISSION ON JAIL STANDARDS (TCJS . STATE . TX . US) - 
VICTIM 

COMPUTER INTRUSIONS - CRIMINAL MATTERS 







UNCLASSIFIED 


To: San Francisco From: San Antonio 

Re: 288A-SA-63452, 04/11/2012 



LEAD(s) ; 

Set Lead 1: (Info) 

CYBER 

AT CCU-1. WASHINGTON, DC 

No hard copy to follow. For information only 
Set Lead 2: (Info) 

CYBER 

AT ecu- 2. WASHINGTON, DC 

No hard copy to follow. For information only 
Set Lead 3 : (Action) 

SAN ANTONIO 

AT SAN ANTONIO, TEXAS 

For evaluation by CI-1 for actionable value. 
Set Lead 4 : (Action) 

SAN ANTONIO 

AT SAN ANTONIO. TEXAS 

For evaluation by CT-4 for actionable value. 


♦♦ 


UNCLASSIFIED//FOR OFFICIAL USE ONLY 


46 


(ReVv 05-01-2008) 


# f 

UNCLASSIPIED//FOR OFFICIAL USE ONLY 

FEDERAL BUREAU OF INVESTIGATION 


Precedence ; ROUTINE 


Date: 04/20/2012 


To: Sacramento 


Attn: CY-1 


From: San Antonio 



TEXAS COMMISSION ON JAIL STANDARDS (TCJS . STATE . TX. US) - 
VICTIM 

COMPUTER INTRUSIONS - CRIMINAL MATTERS 


fivTinr^Hi g « UT/ /Ti’ClTTn 




• 


Enclosure (s) : Enclosed for Sacramento is a CD-ROM containing a 
copy of the database table in MS Excel format . 

Details: (U//FOUO^ Purina the recenti I 



OTHER Persuant to Sealed Court Order 

b6 

b7C 

b7D 










UNCLASSIFIED 


To: Sacramento From: San Antonio 

Re: 288A-SA-63452, 04/20/2012 

LEAD(s) : 

Set Lead 1 : (Action) 


SACRAMENTO 

AT SACRAMENTO 



♦♦ 


UNCLASSIFIED//FOR OFFICIAL USE ONLY 



UNCLASSilPIED 


5 ? 


FD-542 (Rev. 03-23-2009) 




FEDERAL BUREAU OF INVESTIGATION 


Precedence; ROUTINE Date; 05/01/2012 

To; San Antonio 


From; San Antonio 
Cyber/C-4 

Contact ; SA 


Approved By; 


Drafted By; 
Case ID # ; 


288A-SA-63452 (Pending) 




b6 

b7C 


Title; I I ANTISEC; 

TEXAS COMMISSION ON JAIL STANDARDS (TCJS . STATE . TX. US) - 
VICTIM 

COMPUTER INTRUSIONS - CRIMINAL MATTERS 


Synopsis: To claim statistical accomplishment. 



b6 

b7C 

b7D 


; 


b6 

b7C 

b7D 


UNCLASSIFIED 



■t 


UNCLASSIFIED 






To: San Antonio From: San Antonio 

Re: 288A-SA-63452, 02/09/2012 


Accomplishmen'b Inf onnatiph : 

Number: 1 

Type: CIP SUBJECT IDENTIFIED 

ITU: CIP 

Claimed By:| 1 

SSN: 

Name : 

Squad: ^ C-4 

Number: 1 

Type: CIP SEARCH WARRANT OBTAINED AND EXECUTED 

ITU: CIP 

Claimed By: I 
SSN: 

Name : 

Squad: C-4 

b6 

Number: 1 b7c 

Type: CIP CONSENSUAL MONITORING CONDUCTED 

ITU: CIP 

Claimed Byi 

SSN: 

Name: | 

Squad: C-4 

Number: 1 

Type: CIP COMPROMISED SITE IDENTIFIED 

ITU: CIP 

Claimed By:^ 

SSN: 

Name: | 

Squad: C-4 


♦♦ 


UNCLASSIFIED 


2 



(Rev. 05-01-2008) 


• • 

DNCLASSIFIED//FOR OFFICIAL USE ONLY 

FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 05/03/2012 


To: San Antonio Attn: SA | 

Cyber/C-4 


From: 


San Antonio 
Squad CI-1 
Contact: SA 


Approved By: 

Drafted By: 

Case ID #: 288A-SA-63452 (Pending) — (*7 


Title: I 1 ANTISEC 

TEXAS COMMISSION ON JAIL STANDARDS 
( TCJS. STATE. TX. US) - VICTIM 
COMPUTER INTRUSIONS - CRIMINAL MATTERS 


b6 

b7C 


Synopsis: Coverage of lead. 

Full Investigation Initiated: 01/17/2012 


Details: San Antonio CI-1 received a lead regar ding case #288A- 

SA-63452 serial #14 lead #3, Special Agent (SA) I 

and Staff Operations Specialist (SOS) I conducted 

logical investigation of e-mail addresses. To date, FBI San 
Antonio CI-1 has exhausted all investigative resources and no 
priority threats to national security warranting further 
investigation were identified. In the event additional 
derogatory information is discovered, FBI San Antonio CI-1 will 
consider opening an investigation. FBI San Antonio CI-1 
considers this lead covered. 


b6 

b7C 


DNCLASSIFIED//FOR OFFICIAL USE ONLY 


) : ? ( € ho i- 


^i88A'S/^-634i-a-),7 



UNCLASSIFIED//FOR OFFICIAL USETONLY 


To: San Antonio From: San Antonio 

Re: 288A-SA-63452, 05/03/2012 


LEAD(s) ; 

Set Lead 1: (Info) 

SAN ANTONIO 

AT SAN ANTONIO. TX 

C-4 for information only. Read and clear. 


♦♦ 


UNCLASSIFIED//FOR OFFICIAL USE ONLY 


(Rev. 05-01-2008) 


0 

UNCLASSIFIED 

FEDERAL BUREAU OF INVESTIGATION 


Precedence ; PRIORITY 
To : San Antonio 


Date: 05/25/2012 


From: 


San Antonio 
Cyber C-4 
Contact: SA 


Approved By: 

Drafted By: 

Case ID #: 288A-SA-63452 

I 


(Pending) 




b6 

b7C 


Title: 


aka I I ANTISEC; 

TEXAS COMMISSION ON JAIL STANDARDS (TCJS . STATE . TX .US) - 
VICTIM 

COMPUTER INTRUSIONS - CRIMINAL MATTERS 
Synopsis: Case update and investigative plan. 

Details: Writer currently has no CHS coverage of the subject of 

the cap tioned ca se a nd no more open -source leads. A lead was 


sent to[_ 


] RA, 


Division, to attempt to 


physi cally loca te subject at his last known physical address. To 


date, 


RA has been unable to locate the subject. 


[ 


] RA has a CHS that may be able to gain access 


to the subject online and writer has requested that this be 
attempted. Writer has also requested I I RA to ront-i nnp 

attempt to locate the subject. Writer will work with 
provide any needed information or Grand Jury subpoenas. 


to 


Upon locating the subject, whether online or 
physically, writer will use all means available to observe the 
online activity, especially the IP addresses used, by the 
subject. It is anticipated that this will enable writer to link 
past known attacks to the subject beyond a reasonable doubt. 


♦♦ 


UNCLASSIFIED 


SA - 


b7D 



• t 

302 (Rev. 10-6-95) 


- 1 - 

FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 05/31/ 2012 

On May 31, 2012, an employment request was faxed to the 
State of I I Employment Development Department (EDD) , via b6 

^ facsimile number I L The request asked for employment b7c 

® infozTnation from 01/01/2010 through present for the following b7D 

individual : 


Name : 

DOB: 

SSAN: 


Attached and made a part of this document is a copy of 
the request faxed to EDD. 



Investigation on 05/31/2012 
# 288A-SA-63452'^I-^ 


at 


File 


Date dictated not dictated 


by SA 



This document contains neither recommendations nor conclusions of the FBI. It is the property of the tB] 

1 - 3 

1 and is loaned To your a 

gen^ 

f 


b7D 


b6 

b7C 


it and its contents are not to be distributed outside your agency. 




U.S. Department of Justice 
Federal Bureau of Investigation 



In Reply, Please Refer to 
FileNo. 288A-SA-63452 


May 31, 2012 


Attention: To Whom It May Concern 


Re : Employment for 


Dear State of 


Employment Development Department: 


Please provide employment information from 01/01/2010 
through present for the following individual: 


Name : 

DOB: 

SSAN: 


b6 

b7C 

b7D 


Sincerely yours, 

b6 

b7C 


Special Agent 



\9 



UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Precedence; ROUTINE Date; 06/08/2012 

To ; San Antonio 


From; San Antonio 
Cyber/C-4 
Contact; SA 


Approved By; 


Drafted By; 
Case ID #; 


288A-SA-63452 (Pending) > 



Title; 


I ANTI SEC; 

TEXAS COMMISSION ON JAIL STANDARDS (TCJS . STATE . TX. US) 
VICTIM 

COMPUTER INTRUSIONS - CRIMINAL MATTERS 


b6 

b7C 


Synopsis; To claim statistical accomplishment. 


Details; On 6/7/2012, an HR, number 


was published based on CHS| 

reporting. The subject of 


the HR was (U//FOUO) Identification of I nternet Relay Ch at (IRC) 


Channels Used by Anonymous Members, as of 


tJNCLASSIFIED 





r ' 


UNCLASSIFIED 






To: San Antonio From: San Antonio 

Re: 288A-SA-63452, 06/08/2012 


Accomplishment Information: 

Number : 1 

Type: CIP POSITIVE INTELLIGENCE PRODUCT GENERATED (E.G. HR) 

ITU: CIP 

Claimed By^ 

SSN: 

Name : | 

Squad: C-4 


♦♦ 


UNCLASSIFIED 


2 







UNCLASSIFIED 


FD-1023 

( 07 / 24 / 2010 ) 

FEDERAL BUREAU OF INVESTIGATION 

CHS REPORTING DOCUMENT 

HEADER 

Source ID; 




Date: 03/02/2012 


Case Agent 

Name 

Field 

Office/Divisio San Antonio 
n: 


b6 

b7C 


Squad: C Four 


Date of 

Contact 02/22/2012 


List all 
present 
includin 


yoursell 


(Do not 
include 
the 
CHS.): 

Type of 
Contact e-Mail 


b6 

b7C 


Substantiv 
e Case File 

Number: 288A-SA-63452 
Dcheck if Grand Jury restrictions apply 

Source Reporting: CHS provided the following through email: 


b6 

b7C 






UNCLASSIFIED 





UNCLASSIFIED 


FD-1023 

(07/24/2010) 

FEDERAL BUREAU OF INVESTIGATION 

CHS REPORTING DOCUMENT 




HEADER 

Source ID 




Date: 12/06/2011 


Case Agen 
Name 
Field 

Office/Divisio San Antonio 
n: 

Squad: C Four 



Date of 
Contact: 


11/08/2011 


List all 
present 
including 
yourseif.r 
(Do notl 
include 
the 
CHS.): 


Type of 
Contact: 


In Person 


Country un^uED STATES 


City: Lackland AFB 


State 


Texas 




Substantiv 
e Case File 
Number: 288-SJlF=G5i 


533'«UB 




A 

G^HSI 


b6 

b7C 


b6 

b7C 






Dcheck if Grand Jury restrictions appiy 

The report mentions a | lancT 

fuli report provided by the source: 

This is your guide to making sense of everything on this disc. 
[[DISCLAIMER]] 


IS being potentiai actors in the LuizSec group. Beiow is the 


b6 

b7C 


All times in file names are Central. 


b6 

b7C 

b7D 



UNCLASSIFIED 


FD-1023 


(07/24/2010) 


FEDERAL BUREAU OF INVESTIGATION 

CHS REPORTING DOCUMENT 


HEADER 


Source IDj 

Date: 05/10/2012 
Case Agent Name: 

Field Office/Division: san Antonio 
Squad: c Four 


Date of Contact: 05/01/2012 
List all present I 

including yourself.l 

(Do not include 
the CHS.): 

Type of Contact: e-Mail 


Date of Report 


Substantive Case File Number: 288A-SA-63452 


Source Reporting: 



b7D 


Page 1 of 26 


5! ^ 4^9 -ahf 








